CVE-2025-26621

Katalog CVE

CVSS 6.8 · Medium EPSS 0,41%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada citeum opencti. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue.

Rincian

Terbit di NVD

19 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-gq63-jm3h-374p advisory vendor
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mf88-g2wq-p7qm not applicable