CVE-2025-9602

Katalog CVE

CVSS 6.5 · Medium EPSS 0,27%

Kerentanan Incorrect Privilege Assignment pada rockoa. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Rincian

Terbit di NVD

29 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rainrocka/xinhu/issues/9 exploit · issue tracking · advisory vendor
• https://github.com/rainrocka/xinhu/issues/9#issue-3327894144 exploit · issue tracking · advisory vendor
• https://vuldb.com/?id.321778 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.636383 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.321778 permissions required · vdb entry