PT-2025-17446 · Unknown · Mojoportal

0Xlanks + 1 · Publicado 2025-04-21 · Atualizado 2025-04-21 · CVE-2025-28367

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions mojoPortal versions 2.9.0.1 and earlier

Description The issue allows an attacker to perform a Directory Traversal attack via the BetterImageGallery API Controller, specifically through the ImageHandler action. This can lead to unauthorized access to sensitive files, such as the Web.Config file, potentially exposing the MachineKey.

Recommendations For versions 2.9.0.1 and earlier, consider restricting access to the BetterImageGallery API Controller, specifically the ImageHandler action, until a patch is available. As a temporary workaround, limit the exposure of sensitive files like the Web.Config file to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2025-28367

Produtos afetados

Mojoportal

Referências · 8

• https://github.com/i7MEDIA/mojoportal · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-28367 · Nota
• https://osv.dev/vulnerability/CVE-2025-28367 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-28367 · Nota de Segurança
• https://twitter.com/CVEnew/status/1914345980276932796 · Publicação no Twitter
• https://t.me/cvetracker/22058 · Publicação no Telegram
• https://t.me/cvedetector/23453 · Publicação no Telegram
• https://0xlanks.me/blog/cve-2025-28367-advisory · Correção