CVE-2025-51682
Mjobtime 15.7.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-51682 is a critical-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability in Mjobtime Mjobtime. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-51682 is a critical client-side authorization vulnerability (CWE-602) in mJobtime 15.7.2, a time management software. The flaw arises because authorization logic is enforced solely on the client side, allowing attackers to modify client-side code and bypass restrictions to access administrative features. Attackers can also analyze the client-side code to craft direct requests that invoke these administrative functions on the server. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility, low complexity, and lack of prerequisites.
Unauthenticated attackers with network access can exploit this vulnerability without user interaction. By tampering with client-side code in their browser or using tools to intercept and modify requests, they gain unauthorized access to administrative capabilities. Direct request forging based on client-side logic enables remote invocation of sensitive server-side functions, potentially compromising confidentiality, integrity, and availability of the system.
Advisories detailing the vulnerability, including potential mitigations, are available from InfoGuard Labs at https://labs.infoguard.ch/advisories/cve-2025-51682_cve-2025-51683_time_management_softare_sqli-rce/ (covering CVE-2025-51682 and CVE-2025-51683) and the vendor site at http://mjobtime.com. The CVE was published on 2025-12-01.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-200093
Vulnerability Data
mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.7.1V2.2.2V8.3.1V10.4.1
Mitigating Controls (NIST 800-53 r5) AI
Requires a tamper-proof, always-invoked reference monitor that cannot be bypassed by client-side logic.
Enforces all access decisions on the server according to policy rather than trusting client-supplied enforcement.
Enforces information-flow rules at the server boundary instead of delegating them to the client.
Monitors and controls all external and key internal interfaces so that server-side policy cannot be off-loaded to clients.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles discourage client-side trust but do not directly address this weakness.
Security testing can detect client-side enforcement but is not the primary mitigation.
Information access restriction is undermined when the client is trusted to enforce it.
Secure development lifecycle mandates server-side validation and prevents reliance on client enforcement.
Application security requirements explicitly call for server-side enforcement of security mechanisms.
Secure coding standards require server-side checks and reject client-only enforcement.