CVE-2025-4210

MEDIUMNuclei

Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-4210 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 2, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 2, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Casdoor

Browse Casdoor / Casdoor
VulnCheckVersion data not supplied

Casdoor

CVE List1.811affected

github.com/casdoor/casdoor

Browse Go / github.com/casdoor/casdoor
GitHub AdvisoryBefore 1.812.0 · Fixed in 1.812.0affected

Nuclei templates

1
ProjectDiscoveryHIGHCasdoor - Authorization BypassCVSS 7.3

Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access.

Impact

Attackers can bypass authorization, potentially gaining unauthorized access to sensitive data or functionalities.

Remediation

Upgrade to version 1.812.0.

WeaknessesCWE-285
Authorstheamanrawat
Template tagscvecve2025casdoorscimauth-bypassdisclosurevkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe https://nvd.nist.gov/vuln/detail/CVE-2025-4210

Source: ProjectDiscovery

References

8