PT-2025-17591 · Unknown · Rosariosis

Published 2025-04-22 · Updated 2025-04-23 · CVE-2025-29621

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Francois Jacquet RosarioSIS version 12.0.0

Description The issue is related to a content spoofing vulnerability found in the Theme configuration under the My Preferences module. This allows attackers to manipulate application settings.

Recommendations For version 12.0.0, consider restricting access to the Theme configuration under the My Preferences module until a fix is available. As a temporary workaround, limit the ability to manipulate application settings to prevent potential exploitation.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-29621

Affected Products

Rosariosis

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-29621 · Security Note
• https://medium.com/@rudranshsinghrajpurohit/content-spoofing-vulnerability-in-rosariosis-student-information-system-f6101e1ff84d · Note
• https://getastra.com/blog/vulnerability/content-spoofing-vulnerability-in-rosariosis-student-information-system · Note
• https://twitter.com/CVEnew/status/1914759368161005753 · Twitter Post
• https://t.me/cvedetector/23539 · Telegram Post
• https://twitter.com/cybercronai/status/1915152607187775594 · Twitter Post
• https://t.me/cvetracker/22163 · Telegram Post