PT-2025-16237 · Veal98 · Veal98

Caigo · Published 2025-04-14 · Updated 2025-04-14 · CVE-2025-3567

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: veal98 小牛肉 Echo 开源社区系统 version 4.2

Description: A vulnerability was found in the function preHandle of the file src/main/java/com/greate/community/controller/interceptor/LoginTicketInterceptor.java of the component Ticket Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely.

Recommendations: For version 4.2, consider disabling the preHandle function of the LoginTicketInterceptor until a patch is available. Restrict access to the LoginTicketInterceptor component to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-3567

Affected Products

Veal98

References · 8

• 🔥 https://github.com/caigo8/CVE-md/blob/main/Echo/%E4%B8%8D%E5%AE%89%E5%85%A8%E7%9A%84%E6%9D%83%E9%99%90%E6%A0%A1%E9%AA%8C.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3567 · Security Note
• https://t.me/cvetracker/21532 · Telegram Post
• https://vuldb.com/?submit.549537 · Note
• https://vuldb.com/?ctiid.304608 · Note
• https://t.me/cvedetector/22846 · Telegram Post
• https://vuldb.com/?id.304608 · Note
• https://twitter.com/CVEnew/status/1911776652952031272 · Twitter Post