CVE-2025-47817 Details
Description
In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.
A vulnerability allowing privilege escalation has been identified in BlueWave Checkmate versions through 2.0.2 prior to the commit b387eba. This issue arises because profile edit requests can include a role parameter, which could be exploited to grant users elevated permissions.
Users should update to BlueWave Checkmate version 2.0.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 10, 2025CISA-ADP
Assessed May 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bluewave-labs/Checkmate/commit/b387ebaae96fc3a23b090a8baea7a9ebaa70f052 | [email protected] | Source CodeVendor |
| https://github.com/bluewave-labs/Checkmate/pull/2161 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-rq7r-p9cq-5q4f | [email protected] | AdvisoryBroken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-472 | External Control of Assumed-Immutable Web Parameter | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BlueWave Checkmate | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 10, 2025 | New CVE Received | [email protected] |