CVE-2025-55370

Katalog CVE

CVSS 8.8 · High EPSS 0,38%

Kerentanan Authorization Bypass Through User-Controlled Key pada jishenghua jsherp. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.

Rincian

Terbit di NVD

21 Agustus 2025

Terakhir diubah

5 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cina666/CVE/blob/main/jshERP/%E8%B6%8A%E6%9D%83%E8%8E%B7%E5%8F%96%E4%BB%BB%E6%84%8F%E8%B4%A... exploit · advisory pihak ketiga
• https://github.com/jishenghua/jshERP advisory pihak ketiga