PT-2025-12440 · Jalios · Jalios Jplatform+1

Arthur Deloffre + 1 · Publicado 2025-03-21 · Atualizado 2025-03-23 · CVE-2025-25035

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jalios JPlatform versions prior to 10.0.8 Jalios Workplace versions 5.3 through 6.2

Description The issue is related to improper restriction of XML external entity references, allowing XML injection, and improper neutralization of input during web page generation, leading to cross-site scripting (XSS) vulnerabilities, including both reflected and stored XSS.

Recommendations For Jalios JPlatform versions prior to 10.0.8, update to version 10.0.8 or later. For Jalios Workplace versions 5.3 through 6.2, consider disabling any features that generate web pages based on user input until a patch is available.

Correção

XXE

XSS

Enumeração de Fraquezas

CWE-611

CWE-79

Identificadores relacionados

CVE-2025-25035

Produtos afetados

Jalios Jplatform

Jalios Workplace

Referências · 11

• https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19 · Nota
• https://twitter.com/VulmonFeeds/status/1903221492487270687 · Publicação no Twitter
• https://t.me/cvedetector/20839 · Publicação no Telegram
• https://twitter.com/cybercronai/status/1903711137721389100 · Publicação no Twitter
• https://issues.jalios.com/browse/JCMS-11248 · Nota
• https://vulncheck.com/advisories/jalios-jplatform-xss · Nota
• https://issues.jalios.com/browse/JCMS-11259 · Nota
• https://t.me/cvetracker/19637 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1903162830351724721 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-25035 · Nota de Segurança
• https://issues.jalios.com/browse/JCMS-11246 · Nota