CVE-2025-5387

Katalog CVE

CVSS 9.8 · Critical EPSS 0,34%

Kerentanan Incorrect Privilege Assignment pada huayi-tec jeewms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenerate of the component File Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Rincian

Terbit di NVD

31 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.310680 advisory pihak ketiga · vdb entry
• https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV issue tracking
• https://vuldb.com/?ctiid.310680 permissions required · vdb entry