PT-2025-6862 · Ywoa · Ywoa

Rabbit · Publicado 2025-02-12 · Atualizado 2025-02-13 · CVE-2025-1226

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ywoa versions up to 2024.07.03

Description A critical issue has been identified, affecting unknown code in the /oa/setup/setup.jsp file. This leads to improper authorization and can be exploited remotely. The issue has been publicly disclosed.

Recommendations For versions up to 2024.07.03, upgrade to version 2024.07.04 to address this issue. As a temporary workaround, consider restricting access to the /oa/setup/setup.jsp file until the update is applied.

Exploit

Correção

Incorrect Privilege Assignment

Improper Authorization

Enumeração de Fraquezas

CWE-266

CWE-285

Identificadores relacionados

CVE-2025-1226

Produtos afetados

Ywoa

Referências · 7

• 🔥 https://gitee.com/r1bbit/yimioa/issues/IBI7PG · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1226 · Nota de Segurança
• https://vuldb.com/?id.295216 · Nota
• https://twitter.com/CVEnew/status/1889784908346016207 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-1226 · Aviso do Fabricante
• https://vuldb.com/?ctiid.295216 · Nota
• https://twitter.com/CVETracker/status/1890129054516367390 · Publicação no Twitter