CVE-2025-2622

Katalog CVE

CVSS 8.8 · High EPSS 0,73%

Kerentanan Improper Input Validation pada aizuda snail-job. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

22 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitee.com/aizuda/snail-job/issues/IBSQ24 exploit · issue tracking · advisory pihak ketiga
• https://gitee.com/aizuda/snail-job/issues/IBSQ24#note_38500450_link exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?id.300624 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.518999 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.300624 permissions required · vdb entry