CVE-2025-52997

Katalog CVE

CVSS 7.5 · High EPSS 0,54%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada filebrowser. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.

Rincian

Terbit di NVD

30 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-521: Weak Password Requirements
CWE-1392: Use of Default Credentials

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-cm2r-rg7r-p7gg exploit · advisory vendor
• https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93c patch
• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-01_Filebrowser_Insecure_Password_H...