CVE-2025-8797
Litmuschaos Litmus ≤ 3.19.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-8797 is a low-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Litmuschaos Litmus. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-8797 is a critical vulnerability in LitmusChaos Litmus versions up to 3.19.0, affecting an unknown processing component known as the LocalStorage Handler. The issue involves manipulation that leads to permission problems, classified under CWE-266 (Incorrect Privilege Assignment) and CWE-275 (Permission Issues). It carries a CVSS v3.1 base score of 6.3, reflecting network accessibility with low attack complexity.
A remote attacker with low privileges (PR:L) can exploit this vulnerability without user interaction, achieving low impacts on confidentiality, integrity, and availability. The manipulation targets the LocalStorage Handler, enabling unauthorized permission changes that could allow limited data exposure, modification, or disruption within the affected Litmus instance.
Advisories from VulDB detail the issue, noting that the exploit has been publicly disclosed and may be in use, with the vendor contacted early but providing no response. References include VulDB entries (ctiid.319325, id.319325, submit.625991) and a GitHub repository (MaiqueSilva/VulnDB readme07.md), but no patches or official mitigations are specified.
The exploit disclosure increases the risk of active exploitation in unpatched LitmusChaos Litmus deployments up to version 3.19.0.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24079
Vulnerability Data
A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStorage Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has…
more
been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables privilege escalation by manipulating the projectRole in browser localStorage (due to missing backend validation), facilitating exploitation of a software vulnerability for privilege escalation (T1068) and permissions modification akin to file/directory permissions weakness handling (T1222, as cited in VulDB advisory).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access decisions on the LocalStorage Handler so that manipulated permission assignments cannot be exercised by a remote attacker.
Requires that only the minimum privileges needed are assigned, directly countering the CWE-266 incorrect privilege assignment in the affected component.
Mandates proper account and privilege provisioning procedures that would have prevented the unauthorized permission changes introduced via the LocalStorage Handler.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.
Privileged-access-rights control explicitly requires least-privilege assignment and ongoing validation, directly mitigating CWE-266.
Access control policy directly prevents incorrect privilege assignment by defining who may receive which rights.
Segregation of duties reduces blast radius of any single incorrect privilege but does not prevent the assignment itself.
Restricting privileged utility programs limits exposure from over-privileged accounts but does not address how privileges are assigned.
Information-access-restriction mechanisms enforce the correct privilege boundaries once assignment rules are defined.