{"id":"CVE-2025-65681","aliases":["EUVD-2025-199747","GHSA-gq25-78jf-v78c","PYSEC-2025-219"],"status":"published","title":"Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control","description":"An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00229,"percentile":0.13805,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-384","CWE-524"],"published":"2025-11-26T00:00:00Z","modified":"2026-11-04T23:10:00Z","exploits":[{"source":"pocgithub","id":"Rivek619/CVE-2025-65681","title":"Rivek619/CVE-2025-65681","date":"2025-11-24","url":"https://github.com/Rivek619/CVE-2025-65681"}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tutor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20.0.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"tutor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20.0.2"}]}],"versions":["0.1","0.2","0.2.1","12.0.1","12.0.2","12.0.3","12.0.4","12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.2.0","13.0.0","13.0.1","13.0.2","13.0.3","13.1.0","13.1.1","13.1.10","13.1.11","13.1.2","13.1.3","13.1.4","13.1.5","13.1.6","13.1.7","13.1.8","13.1.9","13.2.0","13.2.1","13.2.2","13.2.3","13.3.0","13.3.1","13.3.2","14.0.0","14.0.1","14.0.2","14.0.3","14.0.4","14.0.5","14.1.0","14.1.1","14.1.2","14.2.0","14.2.1","14.2.2","14.2.3","14.2.4","14.2.5","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","15.3.2","15.3.3","15.3.4","15.3.5","15.3.6","15.3.7","15.3.8","15.3.9","16.0.0","16.0.1","16.0.2","16.0.3","16.0.5","16.1.0","16.1.1","16.1.2","16.1.3","16.1.4","16.1.5","16.1.6","16.1.7","16.1.8","17.0.0","17.0.1","17.0.2","17.0.3","17.0.4","17.0.5","17.0.6","18.0.0","18.1.0","18.1.1","18.1.2","18.1.3","18.1.4","18.2.0","18.2.1","18.2.2","19.0.0","19.0.1","19.0.2","19.0.3","19.0.4","19.0.5","20.0.0","20.0.1","20.0.2"]},{"source":"osv","ecosystem":"PyPI","package":"tutor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20.0.2"}]}],"versions":["0.1","0.2","0.2.1","12.0.1","12.0.2","12.0.3","12.0.4","12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.2.0","13.0.0","13.0.1","13.0.2","13.0.3","13.1.0","13.1.1","13.1.10","13.1.11","13.1.2","13.1.3","13.1.4","13.1.5","13.1.6","13.1.7","13.1.8","13.1.9","13.2.0","13.2.1","13.2.2","13.2.3","13.3.0","13.3.1","13.3.2","14.0.0","14.0.1","14.0.2","14.0.3","14.0.4","14.0.5","14.1.0","14.1.1","14.1.2","14.2.0","14.2.1","14.2.2","14.2.3","14.2.4","14.2.5","15.0.0","15.1.0","15.2.0","15.3.0","15.3.1","15.3.2","15.3.3","15.3.4","15.3.5","15.3.6","15.3.7","15.3.8","15.3.9","16.0.0","16.0.1","16.0.2","16.0.3","16.0.5","16.1.0","16.1.1","16.1.2","16.1.3","16.1.4","16.1.5","16.1.6","16.1.7","16.1.8","17.0.0","17.0.1","17.0.2","17.0.3","17.0.4","17.0.5","17.0.6","18.0.0","18.1.0","18.1.1","18.1.2","18.1.3","18.1.4","18.2.0","18.2.1","18.2.2","19.0.0","19.0.1","19.0.2","19.0.3","19.0.4","19.0.5","20.0.0","20.0.1","20.0.2"]}],"products":[{"vendor":"edly","product":"tutor"}],"references":[{"url":"https://github.com/overhangio/tutor","tags":["Product","package"]},{"url":"https://docs.tutor.edly.io","tags":["Product","web"]},{"url":"https://github.com/Rivek619/CVE-2025-65681","tags":["Third Party Advisory","package","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65681","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/tutor/PYSEC-2025-219.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gq25-78jf-v78c","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65681.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-65681","description":"An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.","status":"published","published":"2025-11-26T00:00:00Z","modified":"2025-11-28T21:01:18.964Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-524","CWE-384"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-199747","description":"An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.","status":"published","published":"2025-11-26T00:00:00Z","modified":"2025-11-28T21:01:18Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:11.947161Z"}],"ghsa":[{"id":"GHSA-gq25-78jf-v78c","title":"Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control","description":"An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.","status":"published","published":"2025-11-26T21:31:26Z","modified":"2026-06-08T19:52:18Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2025-65681","description":"An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.","status":"published","published":"2025-11-26T19:15:49.59Z","modified":"2026-11-04T23:10:00.223Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-384","CWE-524"],"updated_at":"2026-11-05T01:45:08.806554Z"}],"osv":[{"id":"CVE-2025-65681","description":"An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.","status":"published","published":"2025-11-26T00:00:00Z","modified":"2026-11-05T21:16:12.477404826Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-05T22:00:58.054534Z"},{"id":"GHSA-gq25-78jf-v78c","title":"Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control","description":"An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.","status":"published","published":"2025-11-26T21:31:26Z","modified":"2026-06-08T20:00:14.442983466Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"PYSEC-2025-219","description":"An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.","status":"published","published":"2025-11-26T19:15:49.59Z","modified":"2026-06-10T17:02:47.384320034Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:54.242332Z"}]}}