CVE-2025-8974

Katalog CVE

CVSS 9.8 · Critical EPSS 0,53%

Kerentanan Use of Hard-coded Password pada linlinjava litemall. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the input X-Litemall-Token leads to hard-coded credentials. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

14 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-259: Use of Hard-coded Password
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/linlinjava/litemall/issues/568 exploit · issue tracking · advisory vendor
• https://github.com/linlinjava/litemall/issues/568#issue-3289860066 exploit · issue tracking · advisory vendor
• https://vuldb.com/?id.319970 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.628233 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.319970 permissions required · vdb entry