PT-2025-17574 · Jmix · Jmix

Knstvk · Publicado 2025-04-22 · Atualizado 2025-12-31 · CVE-2025-32952

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Jmix versions 1.0.0 through 1.6.1 Jmix versions 2.0.0 through 2.3.4

Description The local file storage implementation in Jmix does not restrict the size of uploaded files, allowing an attacker to upload excessively large files and potentially cause the server to run out of space, resulting in a denial of service.

Recommendations For versions 1.0.0 through 1.6.1, update to version 1.6.2. For versions 2.0.0 through 2.3.4, update to version 2.4.0. As a temporary workaround, consider restricting the size of uploaded files to prevent excessive file uploads until a patch is applied.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BDU:2025-06373

CVE-2025-32952

GHSA-F3GV-CWWH-758M

Produtos afetados

Jmix

Referências · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32952.json · Exploit
• https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m · Aviso do Fabricante
• https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa · Correção
• https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a · Correção
• https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2 · Correção
• https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37 · Correção
• https://github.com/jmix-framework/jmix/issues/3804 · Nota
• https://github.com/jmix-framework/jmix/issues/3836 · Nota
• https://github.com/jmix-framework/jmix · Nota
• https://twitter.com/VulmonFeeds/status/1914792733723467941 · Publicação no Twitter
• https://t.me/cveNotify/147325 · Publicação no Telegram
• https://docs.jmix.io/jmix/files-vulnerabilities.html · Aviso do Fabricante
• https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-32952 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-f3gv-cwwh-758m · Aviso do Fabricante