PT-2025-19873 · Netoloji · Netoloji Software E-Flow

Ali Kazar · Publicado 2025-05-06 · Atualizado 2025-05-06 · CVE-2025-0984

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Netoloji Software E-Flow versions prior to 3.23.00

Description The issue affects Netoloji Software E-Flow, allowing unrestricted upload of files with dangerous types and improper neutralization of input during web page generation, which can lead to Stored XSS and File Content Injection. This can enable accessing functionality not properly constrained by ACLs.

Recommendations For versions prior to 3.23.00, update to version 3.23.00 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only allow safe file types and disabling any functionality that allows uploading files with dangerous types until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Correção

XSS

Unrestricted File Upload

Enumeração de Fraquezas

CWE-79

CWE-434

Identificadores relacionados

CVE-2025-0984

Produtos afetados

Netoloji Software E-Flow

Referências · 7

• https://t.me/cvedetector/24608 · Publicação no Telegram
• https://netoloji.com/yazilim-surum-notlari · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-0984 · Nota de Segurança
• https://t.me/cvetracker/23167 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1919718369756119279 · Publicação no Twitter
• https://usom.gov.tr/bildirim/tr-25-0102 · Nota
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0102 · Nota