PT-2025-48710 · Nocobase · Nocobase

28Hus · Publicado 2025-12-02 · Atualizado 2025-12-09 · CVE-2025-13877

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions nocobase versions 1.9.4 and 2.0.0-alpha.37

Description A security issue exists in nocobase that allows for remote attacks with high complexity and difficult exploitability. The issue involves the manipulation of the API KEY argument within an unknown function in the file nocobasepackagescoreauthsrcbasejwt-service.ts of the JWT Service component, leading to the use of a hard-coded cryptographic key. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 1.9.4 and 2.0.0-alpha.37 should be updated.

Exploit

Correção

Enumeração de Fraquezas

CWE-321

CWE-320

Identificadores relacionados

CVE-2025-13877

Produtos afetados

Nocobase

Referências · 9

• 🔥 https://gist.github.com/H2u8s/f3ede60d7ecfe598ae452aa5a8fbb90d · Exploit
• https://twitter.com/VulmonFeeds/status/1996001273926082710 · Publicação no Twitter
• https://vuldb.com/?ctiid.334033 · Nota
• https://twitter.com/CVEnew/status/1995899309469172174 · Publicação no Twitter
• https://vuldb.com/?submit.692205 · Nota
• https://vuldb.com/?id.334033 · Nota
• https://twitter.com/dailycve/status/1998513667659411745 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-13877 · Nota de Segurança
• https://t.me/CVEtracker/38688 · Publicação no Telegram