PT-2025-54686 · Maven · Org.Nutz:Nutzboot-Parent

Publicado 2025-12-01 · Atualizado 2025-12-01

OSV

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the component Transaction API. The manipulation of the argument from/to/wei leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Exploit

Correção

Incorrect Privilege Assignment

Incorrect Authorization

Enumeração de Fraquezas

CWE-266

CWE-863

Identificadores relacionados

GHSA-53V5-9752-QQ92

Produtos afetados

Org.Nutz:Nutzboot-Parent

Referências · 8

• 🔥 https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md#vulnerability-details-and-poc · Exploit
• https://github.com/nutzam/nutzboot · Nota
• https://github.com/Xzzz111/exps/blob/main/archives/nutzboot-UnauthorizedTransfer-1/report.md · Nota
• https://vuldb.com/?submit.692061 · Nota
• https://vuldb.com/?id.333816 · Nota
• https://vuldb.com/?ctiid.333816 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13806 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-53v5-9752-qq92 · Aviso do Fabricante