From b6b73e84cb7fe363eaaf85144e383182b79c7c19 Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Sat, 4 Oct 2025 23:58:56 +0000 Subject: [PATCH] Auto-Update: 2025-10-04T23:55:11.591438+00:00 --- CVE-2025/CVE-2025-112xx/CVE-2025-11273.json | 141 ++++++++++++++++++++ README.md | 8 +- _state.csv | 3 +- 3 files changed, 147 insertions(+), 5 deletions(-) create mode 100644 CVE-2025/CVE-2025-112xx/CVE-2025-11273.json diff --git a/CVE-2025/CVE-2025-112xx/CVE-2025-11273.json b/CVE-2025/CVE-2025-112xx/CVE-2025-11273.json new file mode 100644 index 00000000000..e85b001602d --- /dev/null +++ b/CVE-2025/CVE-2025-112xx/CVE-2025-11273.json @@ -0,0 +1,141 @@ +{ + "id": "CVE-2025-11273", + "sourceIdentifier": "cna@vuldb.com", + "published": "2025-10-04T23:15:40.047", + "lastModified": "2025-10-04T23:15:40.047", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was found in LaChatterie Verger up to 1.2.10. This impacts the function redirectToAuthorization of the file /src/main/services/mcp/oauth/provider.ts. The manipulation of the argument URL results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way." + } + ], + "metrics": { + "cvssMetricV40": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "PROOF_OF_CONCEPT", + "confidentialityRequirement": "NOT_DEFINED", + "integrityRequirement": "NOT_DEFINED", + "availabilityRequirement": "NOT_DEFINED", + "modifiedAttackVector": "NOT_DEFINED", + "modifiedAttackComplexity": "NOT_DEFINED", + "modifiedAttackRequirements": "NOT_DEFINED", + "modifiedPrivilegesRequired": "NOT_DEFINED", + "modifiedUserInteraction": "NOT_DEFINED", + "modifiedVulnConfidentialityImpact": "NOT_DEFINED", + "modifiedVulnIntegrityImpact": "NOT_DEFINED", + "modifiedVulnAvailabilityImpact": "NOT_DEFINED", + "modifiedSubConfidentialityImpact": "NOT_DEFINED", + "modifiedSubIntegrityImpact": "NOT_DEFINED", + "modifiedSubAvailabilityImpact": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED" + } + } + ], + "cvssMetricV31": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "baseScore": 6.5, + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "PARTIAL", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL" + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 6.4, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-20" + }, + { + "lang": "en", + "value": "CWE-502" + } + ] + } + ], + "references": [ + { + "url": "https://lavender-bicycle-a5a.notion.site/Verger-RCE-26153a41781f80b694beebc22ea54579?source=copy_link", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.327007", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.327007", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?submit.655871", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index 1a8151cc906..fda3c4f339e 100644 --- a/README.md +++ b/README.md @@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2025-10-04T22:00:11.329771+00:00 +2025-10-04T23:55:11.591438+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2025-10-04T20:15:40.897000+00:00 +2025-10-04T23:15:40.047000+00:00 ``` ### Last Data Feed Release @@ -33,14 +33,14 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -312845 +312846 ``` ### CVEs added in the last Commit Recently added CVEs: `1` -- [CVE-2025-11272](CVE-2025/CVE-2025-112xx/CVE-2025-11272.json) (`2025-10-04T20:15:40.897`) +- [CVE-2025-11273](CVE-2025/CVE-2025-112xx/CVE-2025-11273.json) (`2025-10-04T23:15:40.047`) ### CVEs modified in the last Commit diff --git a/_state.csv b/_state.csv index fb939b535c5..31713a9bafa 100644 --- a/_state.csv +++ b/_state.csv @@ -286008,7 +286008,8 @@ CVE-2025-11241,0,0,5bb77fd629bb9504cd9927afc9bd20058a0ec2a2916392af3b13a4e42c187 CVE-2025-1125,0,0,64c060281199c9654f8fdd99085ba3139218ea7f460c1edb551cce591e2f94ce,2025-08-12T14:15:27.730000 CVE-2025-1126,0,0,75a0af68b2de42873e4ee33ccd68bb162ec9dabf122dea8ebb0bf11a24b953a1,2025-02-11T17:15:23.537000 CVE-2025-1127,0,0,5cab03037829677b3ff4c77d268b6ebc0b526a062cfabc702392a7f88c64ffc1,2025-02-13T19:15:14.153000 -CVE-2025-11272,1,1,106d49a41d27de5df44879cecfb1465542a3509006aa18e3002be54db56a7f07,2025-10-04T20:15:40.897000 +CVE-2025-11272,0,0,106d49a41d27de5df44879cecfb1465542a3509006aa18e3002be54db56a7f07,2025-10-04T20:15:40.897000 +CVE-2025-11273,1,1,62f00ab730aaeb2f9ace9ec82122f1f6ccc6d811912d032055fed1edf49e33b6,2025-10-04T23:15:40.047000 CVE-2025-1128,0,0,bd81d6e10fbf84089101ce675b6d184578126e11659ee2be1add968261111bfd,2025-02-28T15:59:40.317000 CVE-2025-1131,0,0,97d6312171166f17a719a74c77c3a7e130a8235693ba985972ec2dd99aa0648d,2025-09-24T18:11:24.520000 CVE-2025-1132,0,0,b042f06f56d4d5b7832ab3b846e1c6e3f75f0542bd2b1a2791961ad516dfa1ef,2025-02-25T21:48:03.217000