PT-2025-29509 · Unknown · Job Iteration Api
Calysteon
·
Publicado
2025-07-14
·
Atualizado
2025-07-15
·
CVE-2025-53623
CVSS v4.0
9.3
Crítica
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
Job Iteration API versions prior to 1.11.0
Description:
The Job Iteration API, an extension for ActiveJob, has an arbitrary code execution issue in the
CsvEnumerator class. Exploitation of this issue can lead to unauthorized access, data leakage, or complete system compromise. The issue is fixed in versions 1.11.0 and above. Users should avoid using untrusted input in the CsvEnumerator class and ensure that any file paths are properly sanitized and validated before being passed to the class methods. Users should avoid using the count of rows in file method with untrusted CSV filenames.Recommendations:
Update to Job Iteration API version 1.11.0 or later.
Avoid using the
count of rows in file method with untrusted CSV filenames.
Ensure that any file paths are properly sanitized and validated before being passed to the CsvEnumerator class methods.
Avoid using untrusted input in the CsvEnumerator class.Exploit
Correção
RCE
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Job Iteration Api