PT-2025-17446 · Unknown · Mojoportal

0Xlanks + 1 · Published 2025-04-21 · Updated 2025-04-21 · CVE-2025-28367

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions mojoPortal versions 2.9.0.1 and earlier

Description The issue allows an attacker to perform a Directory Traversal attack via the BetterImageGallery API Controller, specifically through the ImageHandler action. This can lead to unauthorized access to sensitive files, such as the Web.Config file, potentially exposing the MachineKey.

Recommendations For versions 2.9.0.1 and earlier, consider restricting access to the BetterImageGallery API Controller, specifically the ImageHandler action, until a patch is available. As a temporary workaround, limit the exposure of sensitive files like the Web.Config file to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-28367

Affected Products

Mojoportal

References · 8

• https://osv.dev/vulnerability/CVE-2025-28367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-28367 · Security Note
• https://0xlanks.me/blog/cve-2025-28367-advisory · Patch
• https://github.com/i7MEDIA/mojoportal · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-28367 · Note
• https://twitter.com/CVEnew/status/1914345980276932796 · Twitter Post
• https://t.me/cvetracker/22058 · Telegram Post
• https://t.me/cvedetector/23453 · Telegram Post