CVE-2025-4378 | Cleartext Transmission of Sensitive Information, Use of Hard… | CVSS 10.0 CRITICAL

Description

Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentication Abuse, Authentication Bypass. This issue affects ATA-AOF Mobile Application: before 20.06.2025.

Metadata

CVE ID: CVE-2025-4378
State: PUBLISHED
Assigner: TR-CERT
Reserved: 2025-05-06 08:00 UTC
Published: 2025-06-24 16:27 UTC
Last updated: 2026-06-05 14:50 UTC
Primary CWE: CWE-319
CWE-319 Cleartext Transmission of Sensitive Information
Vendor / Product: Ataturk University / ATA-AOF Mobile Application
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Ataturk University	ATA-AOF Mobile Application	—	0 < 20.06.2025

Weakness (CWE)

CWE	Source	Description
CWE-319	cna	CWE-319 Cleartext Transmission of Sensitive Information
CWE-798	cna	CWE-798 Use of Hard-coded Credentials

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References (2)