CVE-2025-35939

Katalog CVE

CVSS 5.3 · Medium KEV · sudah dieksploitasi EPSS 1,3%

Kerentanan External Control of Assumed-Immutable Web Parameter pada craftcms craft cms. Skor CVSS 3.1 5.3 (Medium) menurut NVD. Masuk katalog KEV CISA pada 2 Juni 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

Rincian

Terbit di NVD

7 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-472: External Control of Assumed-Immutable Web Parameter

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Masuk KEV

2 Juni 2025

Tenggat CISA

23 Juni 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/craftcms/cms/pull/17220 patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939 pemerintah AS
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json advisory pihak ketiga
• https://github.com/craftcms/cms/releases/tag/4.15.3 release notes
• https://github.com/craftcms/cms/releases/tag/5.7.5 release notes
• https://www.cve.org/CVERecord?id=CVE-2025-35939 vdb entry