PT-2025-17577 · Cuba Jpa · Cuba Jpa

Knstvk · Published 2025-04-22 · Updated 2025-04-22 · CVE-2025-32961

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cuba JPA versions prior to 1.1.1

Description The Cuba JPA web API allows loading and saving entities defined in the application data model through simple HTTP requests. Prior to version 1.1.1, the input parameter, which includes a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand.

Recommendations For versions prior to 1.1.1, update to version 1.1.1 to resolve the issue. As a temporary workaround, consider using the workaround provided on the Jmix documentation website until the update to version 1.1.1 can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-32961

GHSA-HG25-W3VG-7279

Affected Products

Cuba Jpa

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32961.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-32961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32961 · Security Note
• https://osv.dev/vulnerability/GHSA-hg25-w3vg-7279 · Vendor Advisory
• https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93 · Note
• https://github.com/cuba-platform/jpawebapi · Note
• https://github.com/cuba-platform/jpawebapi/commit/78b837d7e2b12d0df69cef1bc6042ebf3bdaf22c · Note
• https://github.com/cuba-platform/jpawebapi/security/advisories/GHSA-hg25-w3vg-7279 · Note
• https://t.me/cvedetector/23555 · Telegram Post
• https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application · Note
• https://docs.jmix.io/jmix/files-vulnerabilities.html · Note
• https://twitter.com/CVEnew/status/1914746237309329567 · Twitter Post
• https://t.me/cvetracker/22150 · Telegram Post