HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxPsuUsage` API endpoint, related to a flat present in open-apis versions up to and including 10.0.2. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g., HAX-3), this could assist in targeted attacks such as unauthorized content modification or deletion. Commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 patches the vulnerability.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-16686 | Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint |
 Github GHSA |
GHSA-fvx2-x7ff-fc56 | Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 03 Jun 2025 02:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 02 Jun 2025 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. Prior to open-apis commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7, an unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxPsuUsage` API endpoint. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g., HAX-3), this could assist in targeted attacks such as unauthorized content modification or deletion. Commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 patches the vulnerability. | HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxPsuUsage` API endpoint, related to a flat present in open-apis versions up to and including 10.0.2. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g., HAX-3), this could assist in targeted attacks such as unauthorized content modification or deletion. Commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 patches the vulnerability. |
Mon, 02 Jun 2025 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. Prior to open-apis commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7, an unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxPsuUsage` API endpoint. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g., HAX-3), this could assist in targeted attacks such as unauthorized content modification or deletion. Commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 patches the vulnerability. | |
| Title | Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint | |
| Weaknesses | CWE-201 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-06-03T02:04:15.413Z
Reserved: 2025-05-29T16:34:07.174Z
Link: CVE-2025-48996
Vulnrichment
Updated: 2025-06-03T02:04:12.260Z
NVD
Status : Awaiting Analysis
Published: 2025-06-02T20:15:23.063
Modified: 2025-06-04T14:54:33.783
Link: CVE-2025-48996
Redhat
No data.
OpenCVE Enrichment
No data.