CVE-2025-1225

Katalog CVE

CVSS 6.3 · Medium EPSS 0,38%

Kerentanan Externally Controlled Reference to a Resource in Another Sphere pada r1bbit yimioa. Skor CVSS 3.1 6.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity reference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

12 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-610: Externally Controlled Reference to a Resource in Another Sphere
CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitee.com/r1bbit/yimioa/issues/IBI81R exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?id.295211 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.295211 permissions required · vdb entry