PT-2025-17869 · Unknown · Sherpa Orchestrator

Artem Brylev · Published 2025-04-25 · Updated 2025-10-16 · CVE-2025-46547

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sherpa Orchestrator version 141851

Description The web application lacks protection against CSRF attacks, allowing an attacker to conduct XSS attacks, add a new user or role, or exploit a SQL injection issue.

Recommendations For Sherpa Orchestrator version 141851, consider implementing protection against CSRF attacks to prevent exploitation. As a temporary workaround, restrict access to sensitive features that could be exploited through CSRF attacks, such as user or role management. Avoid using the web application for sensitive operations until the CSRF protection issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-46547

Affected Products

Sherpa Orchestrator

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-46547 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46547 · Vendor Advisory
• https://t.me/cvetracker/22341 · Telegram Post
• https://t.me/cveNotify/139068 · Telegram Post
• https://t.me/cvedetector/23724 · Telegram Post
• https://deiteriy.com · Note
• https://sherparpa.com · Note
• https://twitter.com/CVEnew/status/1915614843614188026 · Twitter Post
• https://t.me/cvenotify/119762 · Telegram Post
• https://twitter.com/ArtyomBrylev · Note
• https://gist.github.com/ArtemBrylev/9af206c46d7505db03ad6fcd9fc46f7f · Note