CVE-2025-47411
Improper Privilege Management: Is CVE-2025-47411 real, exploitable, or a false positive? Here's the community verdict.
Community verdict: No field verdicts yet. Be the first practitioner to weigh in.
signals
public sources
Moderate signals. Triage by your actual exposure and reachability.
cisa ssvc
CISA Vulnrichment · assessed
CISA decision, by how critical the affected system is to you:
- low impact → Track
- medium impact → Track
- high impact → Track*
Track: normal patch cycle · Track*: watch closely · Attend: patch sooner · Act: patch now. About SSVC ↗
baseline read
auto · not a community verdict
Low signal — verdict needed
Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2025-47411)<a href="https://www.truepositive.app/cve/CVE-2025-47411"><img src="https://www.truepositive.app/cve/CVE-2025-47411/badge.svg" alt="TruePositive verdict for CVE-2025-47411"></a>Live badge that updates automatically as the community verdict changes.
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: A curated baseline from public sources, shown separately from community verdicts.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
No confirmed in-the-wild exploitation or public exploit was found for this yet. FIRST EPSS estimates about a 15% chance of exploitation in the next 30 days, which is high relative to most CVEs.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-269 · Improper Privilege Management.
- CVE-2017-5689CRIT 9.8KEVEPSS 92%
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
- CVE-2021-20021CRIT 9.8KEVEPSS 89%
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
- CVE-2016-0151HIGH 7.8KEVEPSS 63%
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
- CVE-2020-8655HIGH 7.8KEVEPSS 60%
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
- CVE-2019-13272HIGH 7.8KEVEPSS 52%
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
- CVE-2014-3153HIGH 7.8KEVEPSS 37%
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.