diff --git a/2025/5xxx/CVE-2025-5140.json b/2025/5xxx/CVE-2025-5140.json index b7d25d635e3..d76a8c705df 100644 --- a/2025/5xxx/CVE-2025-5140.json +++ b/2025/5xxx/CVE-2025-5140.json @@ -1,17 +1,109 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-5140", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2. This affects the function this.oursNetService.getData of the file com\\ours\\www\\ehr\\openPlatform1\\open4ClientType\\controller\\ThirdMenuController.class. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "Es wurde eine Schwachstelle in Seeyon Zhiyuan OA Web Application System bis 8.1 SP2 entdeckt. Sie wurde als kritisch eingestuft. Hiervon betroffen ist die Funktion this.oursNetService.getData der Datei com\\ours\\www\\ehr\\openPlatform1\\open4ClientType\\controller\\ThirdMenuController.class. Durch Beeinflussen des Arguments url mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Server-Side Request Forgery", + "cweId": "CWE-918" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Seeyon", + "product": { + "product_data": [ + { + "product_name": "Zhiyuan OA Web Application System", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "8.1 SP2" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.310221", + "refsource": "MISC", + "name": "https://vuldb.com/?id.310221" + }, + { + "url": "https://vuldb.com/?ctiid.310221", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.310221" + }, + { + "url": "https://vuldb.com/?submit.574440", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.574440" + }, + { + "url": "https://wx.mail.qq.com/s?k=i0-p-2N4MHcFOeM00E", + "refsource": "MISC", + "name": "https://wx.mail.qq.com/s?k=i0-p-2N4MHcFOeM00E" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "caichaoxiong (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" } ] }