Name and e-mail of employee that has done a publication is discoverable in gpp-burgerportaal
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-359.
Summary
gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name and email address of employees who publish content are exposed in network responses and can be discovered by viewing the browser's developer tools network tab. This information disclosure may violate employee privacy expectations and could be used for targeted attacks or unwanted contact. This issue has been patched in versions 2.0.3, 3.0.2, and 4.0.1. No known workarounds exist.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GPP-Woo | GPP-burgerportaal | before 2.0.3; 3.0.0-rc.0 to before 3.0.2; 4.0.0-rc.0 to before 4.0.1 | 2.0.3, 3.0.2, 4.0.1 | Patch available | CNA |
- GPP-burgerportaal VendorGPP-Woo Affected before 2.0.3; 3.0.0-rc.0 to before 3.0.2; 4.0.0-rc.0 to before 4.0.1 Fixed in 2.0.3, 3.0.2, 4.0.1 Patch available CNA
Remediation
- Fix · CNA GPP-burgerportaal (GPP-Woo) Fixed in 2.0.3, 3.0.2, 4.0.1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62362
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences