CVE-2025-63551

Katalog CVE

CVSS 7.5 · High EPSS 0,51%

Kerentanan Improper Restriction of XML External Entity Reference pada metinfo. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path `/admin/#/webset/?head_tab_active=0`, where user-provided XML data is processed.

Rincian

Terbit di NVD

6 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection exploit · advisory pihak ketiga
• https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection/blob/main/README.md exploit · advisory pihak ketiga