CVE-2025-7759

Katalog CVE

CVSS 8.8 · High EPSS 0,36%

Kerentanan Server-Side Request Forgery (SSRF) pada jeesite. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 1c5e49b0818037452148e0f8ff69ed04cb8fefdc. It is advisable to implement a patch to correct this issue.

Rincian

Terbit di NVD

17 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/thinkgem/jeesite5/commit/1c5e49b0818037452148e0f8ff69ed04cb8fefdc patch
• https://vuldb.com/?id.316749 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.615769 advisory pihak ketiga · vdb entry
• https://github.com/thinkgem/jeesite5/issues/27 exploit · issue tracking
• https://github.com/MentalityXt/jeesite_ssrf/tree/main
• https://vuldb.com/?ctiid.316749 permissions required · vdb entry