CVE-2025-2089: StarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access control

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-07 · updated 2026-06-17
Weakness: CWE-266

Description

A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

StarSea99 starsea-mall: 1.0.0

References

https://vuldb.com/?ctiid.298903
https://vuldb.com/?id.298903
https://vuldb.com/?submit.514977
https://wiki.shikangsi.com/post/share/baecf028-1116-4600-ae9c-f655cc93c29b
https://wiki.shikangsi.com/post/share/baecf028-1116-4600-ae9c-f655cc93c29b

Get alerted when CVE-2025-2089 or the next vulnerability affects your stack