CVE-2025-43703

Katalog CVE

CVSS 5.4 · Medium EPSS 0,23%

Kerentanan Inclusion of Web Functionality from an Untrusted Source pada ankitects anki. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.

Rincian

Terbit di NVD

16 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-830: Inclusion of Web Functionality from an Untrusted Source

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ankitects/anki/pull/3925 issue tracking · patch
• https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709 patch