PT-2025-23461 · Unknown · Juzawebcms

Cyber-Wo0Dy · Publicado 2025-06-02 · Atualizado 2025-06-16 · CVE-2025-5428

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions juzaweb CMS versions up to 3.4.2

Description A critical issue has been discovered, affecting an unknown part of the file /admin-cp/log-viewer of the component Error Logs Page. This leads to improper access controls, allowing for remote attacks. The issue has been publicly disclosed.

Recommendations For juzaweb CMS versions up to 3.4.2, update to a version later than 3.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the /admin-cp/log-viewer endpoint until a patch is available.

Exploit

Correção

Incorrect Privilege Assignment

Improper Access Control

Enumeração de Fraquezas

CWE-266

CWE-284

Identificadores relacionados

CVE-2025-5428

Produtos afetados

Juzawebcms

Referências · 10

• 🔥 https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_unprivileged_user_list_delete_logs.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-5428 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1929394313730895970 · Publicação no Twitter
• https://vuldb.com/?submit.584056 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-5428 · Nota de Segurança
• https://t.me/cvenotify/125810 · Publicação no Telegram
• https://vuldb.com/?id.310761 · Nota
• https://vuldb.com/?ctiid.310761 · Nota
• https://t.me/cvetracker/25131 · Publicação no Telegram
• https://t.me/cvenotify/124297 · Publicação no Telegram