PT-2025-22562 · Schule · Schule

Ibnusued · Published 2025-05-22 · Updated 2025-05-22 · CVE-2025-48372

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Schule versions prior to 1.0.1

Description The issue concerns the generateOTP() function, which generates a 4-digit numeric One-Time Password (OTP) with a limited range of 9000 possible combinations. This small keyspace makes the OTP highly vulnerable to brute-force attacks, especially in the absence of strong rate-limiting or lockout mechanisms.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 to fix the issue. As a temporary workaround, consider implementing strong rate-limiting or lockout mechanisms to minimize the risk of exploitation. Restrict access to the generateOTP() function until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2025-48372

GHSA-6C48-67XX-VQGC

Affected Products

Schule

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48372.json · Exploit
• https://github.com/schule111/Schule/commit/cd53abbea93943f2c60a5281d45bebadc57636b7 · Patch
• https://github.com/schule111/Schule/security/advisories/GHSA-6c48-67xx-vqgc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48372 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48372 · Vendor Advisory
• https://twitter.com/CVEnew/status/1925656009634189512 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925670496248422735 · Twitter Post