CVE-2025-8814

Katalog CVE

CVSS 4.3 · Medium EPSS 0,36%

Kerentanan Cross-Site Request Forgery (CSRF) pada pybbs project pybbs. Skor CVSS 3.1 4.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.

Rincian

Terbit di NVD

10 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)
CWE-862: Missing Authorization

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/atjiu/pybbs/commit/8aa2bb1aef3346e49aec6358edf5e47ce905ae7b patch
• https://vuldb.com/?id.319343 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.622334 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.622353 advisory pihak ketiga · vdb entry
• https://github.com/atjiu/pybbs/issues/211 exploit · issue tracking
• https://github.com/atjiu/pybbs/issues/211#issue-3256483043 exploit · issue tracking
• https://github.com/atjiu/pybbs/issues/211#issuecomment-3134960777 issue tracking
• https://vuldb.com/?ctiid.319343 permissions required · vdb entry