An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Ankitects |
|
No data.
References
History
Thu, 09 Oct 2025 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:* |
Thu, 17 Apr 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 16 Apr 2025 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484. | |
| Weaknesses | CWE-830 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2025-04-16T00:00:00.000Z
Updated: 2025-04-17T13:56:42.103Z
Reserved: 2025-04-16T00:00:00.000Z
Link: CVE-2025-43703
Vulnrichment
Updated: 2025-04-17T13:41:28.519Z
NVD
Status : Analyzed
Published: 2025-04-16T22:15:15.083
Modified: 2025-10-09T14:56:21.430
Link: CVE-2025-43703
Redhat
No data.