CVE-2025-9031 - Vulnerability Details - OpenCVE

Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing.This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Netdatasoft	Divvy Drive

No data.

No data.

References

Link	Providers
https://www.usom.gov.tr/bildirim/tr-25-0293

History

Thu, 25 Sep 2025 08:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Netdatasoft Netdatasoft divvy Drive
Vendors & Products		Netdatasoft Netdatasoft divvy Drive

Wed, 24 Sep 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 24 Sep 2025 08:45:00 +0000

Type	Values Removed	Values Added
Description		Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing.This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.
Title		Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web
Weaknesses		CWE-203 CWE-208
References		https://www.usom.gov.tr/bildirim/tr-25-0293
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2025-09-24T08:25:49.377Z

Updated: 2025-09-24T14:04:08.007Z

Reserved: 2025-08-14T10:53:12.468Z

Link: CVE-2025-9031

Vulnrichment

Updated: 2025-09-24T14:04:02.996Z

NVD

Status : Awaiting Analysis

Published: 2025-09-24T09:15:31.267

Modified: 2025-09-24T18:11:24.520

Link: CVE-2025-9031

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-9031", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-08-14T10:53:12.468Z", "datePublished": "2025-09-24T08:25:49.377Z", "dateUpdated": "2025-09-24T14:04:08.007Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DivvyDrive Web", "vendor": "DivvyDrive Information Technologies Inc.", "versions": [{"lessThan": "4.8.2.15", "status": "affected", "version": "4.8.2.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Emre AKTA\u015e"}], "datePublic": "2025-09-24T08:23:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing.<p>This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.</p>"}], "value": "Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing.This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15."}], "impacts": [{"capecId": "CAPEC-462", "descriptions": [{"lang": "en", "value": "CAPEC-462 Cross-Domain Search Timing"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-203", "description": "CWE-203 Observable Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2025-09-24T08:27:54.146Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0293"}], "source": {"advisory": "TR-25-0293", "defect": ["TR-25-0293"], "discovery": "UNKNOWN"}, "title": "Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-24T14:03:58.151545Z", "id": "CVE-2025-9031", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T14:04:08.007Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9031", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-24T14:03:58.151545Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-24T14:04:02.996Z"}}], "cna": {"title": "Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web", "source": {"defect": ["TR-25-0293"], "advisory": "TR-25-0293", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Emre AKTA\u015e"}], "impacts": [{"capecId": "CAPEC-462", "descriptions": [{"lang": "en", "value": "CAPEC-462 Cross-Domain Search Timing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "DivvyDrive Information Technologies Inc.", "product": "DivvyDrive Web", "versions": [{"status": "affected", "version": "4.8.2.2", "lessThan": "4.8.2.15", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-09-24T08:23:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0293"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing.This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.", "supportingMedia": [{"type": "text/html", "value": "Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing.<p>This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-203", "description": "CWE-203 Observable Discrepancy"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2025-09-24T08:27:54.146Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9031", "state": "PUBLISHED", "dateUpdated": "2025-09-24T14:04:08.007Z", "dateReserved": "2025-08-14T10:53:12.468Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2025-09-24T08:25:49.377Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.1"}