PT-2025-48268 · Unknown · Wirtualna Uczelnia

Marcin Ressel · Publicado 2025-11-27 · Atualizado 2025-11-27 · CVE-2025-12140

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wirtualna Uczelnia versions prior to wu#2016.1.5513#0#20251014 113353

Description The application has an insecure 'redirectToUrl' mechanism that incorrectly processes the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, potentially allowing an unauthenticated attacker to execute arbitrary code. The vulnerable component is the processing of the redirectUrlParameter parameter within the 'redirectToUrl' mechanism.

Recommendations Update Wirtualna Uczelnia to version wu#2016.1.5513#0#20251014 113353 or later.

Correção

RCE

Eval Injection

Enumeração de Fraquezas

CWE-95

Identificadores relacionados

CVE-2025-12140

Produtos afetados

Wirtualna Uczelnia

Referências · 7

• https://t.me/CVEtracker/38390 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-12140 · Nota de Segurança
• https://twitter.com/CVEnew/status/1994053245556117718 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/1994046071723487375 · Publicação no Twitter
• https://t.me/cveNotify/144187 · Publicação no Telegram
• https://cert.pl/posts/2025/11/CVE-2025-12140 · Nota
• https://twitter.com/lowcountrycyber/status/1994123037243826629 · Publicação no Twitter