CVE-2025-47945

Katalog CVE

CVSS 9.8 · Critical EPSS 0,69%

Kerentanan Insecure Default Variable Initialization pada donetick. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate. The vulnerability is proven by existence of the issue in the live version as well. This issue can result in full account takeover of any user. Version 0.1.44 contains a patch.

Rincian

Terbit di NVD

17 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-453: Insecure Default Variable Initialization
CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/donetick/donetick/security/advisories/GHSA-hjjg-vw4j-986x exploit · advisory vendor
• https://github.com/donetick/donetick/commit/620b897bc0135f6668bb8a5562678104531108eb patch
• https://github.com/donetick/donetick/commit/b9a6e177eefdc605dedbc5320f0d93d6573d1db6 patch