CVE-2025-52968

Katalog CVE KUTIM-CSIRT

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2025-52968

Katalog CVE

CVSS 2.7 · Low EPSS 0,21%

Kerentanan Unprotected Alternate Channel. Skor CVSS 3.1 2.7 (Low) menurut mitre.org.

Deskripsi (NVD)

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.

Rincian

Terbit di NVD
23 Juni 2025
Terakhir diubah
17 Juni 2026
Status NVD
Deferred
CVSS 3.1
2.7 (Low), sumber mitre.org
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-420: Unprotected Alternate Channel
EPSS (30 hari)
0,21% peluang dieksploitasi; lebih tinggi dari 10,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.