PT-2025-23188 · Fossasia · Open-Event-Server

Gavin Zhong · Published 2025-05-29 · Updated 2025-05-29 · CVE-2025-5323

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions fossasia open-event-server version 1.19.1

Description A problematic issue has been found in the Mail Verification Handler component, specifically affecting the send email change user email function. This issue leads to reliance on obfuscation or encryption of security-relevant inputs without integrity checking, allowing for potential remote attacks. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations For fossasia open-event-server version 1.19.1, consider disabling the send email change user email function until a patch is available to prevent potential exploitation. Restrict access to the Mail Verification Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-325

CWE-649

Related Identifiers

CVE-2025-5323

Affected Products

Open-Event-Server

References · 8

• 🔥 https://gist.github.com/superboy-zjc/31ecea91b304b8dd9871ad507467ca61 · Exploit
• 🔥 https://gist.github.com/superboy-zjc/31ecea91b304b8dd9871ad507467ca61#proof-of-concept · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5323 · Security Note
• https://t.me/cvetracker/24920 · Telegram Post
• https://twitter.com/CVEnew/status/1928161854897176769 · Twitter Post
• https://vuldb.com/?id.310493 · Note
• https://vuldb.com/?ctiid.310493 · Note
• https://vuldb.com/?submit.580256 · Note