Vulnerabilities

TI-2025-21373 CVE-2025-29998 · GHSA-cwqf-2qf9-9mh4

No Rate Limiting Vulnerability in CAP back office application

LOW 36

This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00386 Published 2025-03-13 Fixed in 2.0.4 CWE-799

TI-2025-21372 CVE-2025-29997 · GHSA-69gq-6xvx-r4vv

LOW 36

This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00368 Published 2025-03-13 Fixed in 2.0.4 CWE-863

TI-2025-21371 CVE-2025-29996 · GHSA-9qpx-c9x4-hcg8

LOW 36

This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00443 Published 2025-03-13 Fixed in 2.0.4 CWE-288

TI-2025-21370 CVE-2025-29995 · GHSA-2rrx-p33r-295r

LOW 38

This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00365 Published 2025-03-13 Fixed in 2.0.4 CWE-640

TI-2025-21369 CVE-2025-29994 · GHSA-j28r-mxrm-39f3

LOW 36

This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00421 Published 2025-03-13 Fixed in 2.0.4 CWE-1390