CVE-2025-8838

Katalog CVE

CVSS 9.8 · Critical EPSS 0,55%

Kerentanan Improper Authentication pada winterchens my-site. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The code maintainer responded to the issue that "[he] tried it, and using this link automatically redirects to the login page."

Rincian

Terbit di NVD

11 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.319372 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.622421 advisory pihak ketiga · vdb entry
• https://github.com/WinterChenS/my-site/issues/97 exploit · issue tracking
• https://github.com/WinterChenS/my-site/issues/97#issuecomment-2986947791 issue tracking
• https://github.com/WinterChenS/my-site/issues/97#issuecomment-2987091571 issue tracking
• https://vuldb.com/?ctiid.319372 permissions required · vdb entry