PT-2025-23408 · Jeewms · Jeewms

Published 2025-05-31 · Updated 2025-05-31 · CVE-2025-5384

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JeeWMS versions up to 20250504

Description A critical issue was found, affecting the function CgAutoListController of the file "/cgAutoListController.do?datagrid". This issue leads to sql injection and can be initiated remotely. The product uses rolling releases, so version details for affected and updated releases are not available.

Recommendations For versions up to 20250504, as a temporary workaround, consider disabling the CgAutoListController function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-5384

Affected Products

Jeewms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-5384 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5384 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1928853820852879597 · Twitter Post
• https://twitter.com/CVEnew/status/1928854314996441335 · Twitter Post
• https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV · Note
• https://vuldb.com/?ctiid.310677 · Note
• https://vuldb.com/?id.310677 · Note
• https://t.me/cvenotify/124249 · Telegram Post
• https://t.me/cvetracker/25089 · Telegram Post