CVE-2025-4762

Insecure Direct Object Reference (IDOR) vulnerability exists in the eSignaViewer component of eSigna product versions 1.0 to 1.5. The vulnerability stems from insufficient authorization checks on user-controlled object references, such as document IDs and file paths, allowing attackers to bypass intended access controls.

An unauthenticated attacker can exploit this by crafting malicious requests that manipulate file paths or object identifiers to access arbitrary files in the document system. No authentication is required, and the attack can be performed remotely over the network.

Successful exploitation enables unauthorized reading of potentially sensitive files stored in the document system, which could lead to data exposure and regulatory compliance violations. However, the overall impact is considered low severity.

Lleidanet PKI has released patched versions of eSignaViewer that implement stronger input validation and robust authorization controls. Organizations are strongly advised to upgrade to the latest versions and adopt complementary security measures such as logging suspicious activities and performing regular security audits [1].