CVE-2025-14602

Katalog CVE

CVSS 5.3 · Medium EPSS 0,46%

Kerentanan Generation of Predictable Numbers or Identifiers. Skor CVSS 4.0 5.3 (Medium) menurut kaspersky.com.

Deskripsi (NVD)

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Rincian

Terbit di NVD

20 Agustus 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Deferred

CVSS 4.0

5.3 (Medium), sumber kaspersky.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-340: Generation of Predictable Numbers or Identifiers
CWE-377: Insecure Temporary File

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/klsecservices/Advisories/blob/master/KLSA-00294-Weak-File-Name-Generation-in-vsDesk.md