CVE-2025-5321

MEDIUM

Aim run_view RestrictedPythonQuery - Remote Privilege Escalation

Title source: manual
STIX 2.1

Description

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.310492
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.310492
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.580253

Scores

CVSS v3 6.3
EPSS 0.0038
EPSS Percentile 59.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-265 CWE-264
Status published
Products (2)
aimstack/aim < 3.29.1
pypi/aim 0PyPI
Published May 29, 2025
Tracked Since Feb 18, 2026