CVE-2025-48187

Katalog CVE

CVSS 9.8 · Critical EPSS 0,55%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada infiniflow ragflow. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.

Rincian

Terbit di NVD

17 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/infiniflow/ragflow/commits/main/ patch
• https://www.cnblogs.com/qiushuo/p/18881084 exploit