CVE-2025-43955

Katalog CVE

CVSS 6.8 · Medium EPSS 0,35%

Kerentanan Exposed Dangerous Method or Function pada convertigo. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

Rincian

Terbit di NVD

20 April 2025

Terakhir diubah

28 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-749: Exposed Dangerous Method or Function
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1 patch
• https://github.com/convertigo/convertigo/issues/898 exploit · issue tracking
• https://github.com/convertigo/convertigo/blob/8.3.11/CHANGELOG.md#8311 release notes
• https://github.com/convertigo/convertigo/releases/tag/8.3.11 release notes