admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-05-06 10:41:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

"-Synchronized-Data."

Browse Source
This commit is contained in:
CVE Team 2025-04-07 20:00:48 +00:00
parent 07d9448b6d
commit 4ddaae3609
No known key found for this signature in database
GPG Key ID: BC5FD8F2443B23B7
1 changed files with 105 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

109
2025/3xxx/CVE-2025-3382.json
View File

@ -1,17 +1,118 @@
{ {
"data_version": "4.0",
"data_type": "CVE", "data_type": "CVE",
"data_format": "MITRE", "data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": { "CVE_data_meta": {
"ID": "CVE-2025-3382", "ID": "CVE-2025-3382",
"ASSIGNER": "cve@mitre.org", "ASSIGNER": "cna@vuldb.com",
"STATE": "RESERVED" "STATE": "PUBLIC"
}, },
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." "value": "A vulnerability has been found in joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 and classified as critical. This vulnerability affects the function update of the file /api/user/update. The manipulation of the argument state leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available."
},
{
"lang": "deu",
"value": "In joey-zhou xiaozhi-esp32-server-java bis a14fe8115842ee42ab5c7a51706b8a85db5200b7 wurde eine kritische Schwachstelle gefunden. Dabei geht es um die Funktion update der Datei /api/user/update. Mittels Manipulieren des Arguments state mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Dieses Produkt verzichtet auf eine Versionierung und verwendet stattdessen Rolling Releases. Deshalb sind keine Details zu betroffenen oder zu aktualisierende Versionen vorhanden."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "SQL Injection",
"cweId": "CWE-89"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Injection",
"cweId": "CWE-74"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "joey-zhou",
"product": {
"product_data": [
{
"product_name": "xiaozhi-esp32-server-java",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "a14fe8115842ee42ab5c7a51706b8a85db5200b7"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://vuldb.com/?id.303628",
"refsource": "MISC",
"name": "https://vuldb.com/?id.303628"
},
{
"url": "https://vuldb.com/?ctiid.303628",
"refsource": "MISC",
"name": "https://vuldb.com/?ctiid.303628"
},
{
"url": "https://vuldb.com/?submit.552387",
"refsource": "MISC",
"name": "https://vuldb.com/?submit.552387"
},
{
"url": "https://github.com/exp3n5ive/Vul/blob/main/xiaozhi-sqli/xiaozhi-sqli.md",
"refsource": "MISC",
"name": "https://github.com/exp3n5ive/Vul/blob/main/xiaozhi-sqli/xiaozhi-sqli.md"
}
]
},
"credits": [
{
"lang": "en",
"value": "exp3n5ive (VulDB User)"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"baseScore": 6.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "3.0",
"baseScore": 6.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "2.0",
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P"
} }
] ]
} }