Skip to content
OpenAdvisories
Critical ICSA-25-063-07 4 CVEs

GMOD Apollo

Published Mar 4, 2025 · Updated Mar 4, 2025

Vendor: GMOD Product: Apollo

Summary

Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges, bypass authentication, upload malicious files, or disclose sensitive information.

Vulnerabilities 4

  • Critical 9.8
    CVE-2025-23410

    GMOD Apollo Relative Path Traversal

    When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.

    GMOD Apollo
  • Critical 9.8
    CVE-2025-24924

    GMOD Apollo Missing Authentication for Critical Function

    Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username

    GMOD Apollo
  • Medium 6.5
    CVE-2025-21092

    GMOD Apollo Incorrect Privilege Assignment

    GMOD Apollo does not have sufficient logical or access checks when updating a user's information. This could result in an attacker being able to escalate privileges for themselves or others.

    GMOD Apollo
  • Medium 5.3
    CVE-2025-20002

    GMOD Apollo Generation of Error Message Containing Sensitive Information

    After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure

    GMOD Apollo

Revision history

  1. #1

    Initial Publication

References