PT-2025-23412 · Jeewms · Jeewms

李响 · Published 2025-05-31 · Updated 2025-05-31 · CVE-2025-5387

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JeeWMS up to 20250504

Description A critical issue has been discovered, affecting the dogenerate function of the /generateController.do?dogenerate file in the File Handler component. This leads to improper access controls, allowing remote attacks. The product uses a rolling release model for continuous delivery, so specific version details for affected or updated releases are not available.

Recommendations For JeeWMS up to 20250504, consider disabling the dogenerate function of the /generateController.do?dogenerate file as a temporary workaround until a fix is available. Restrict access to the File Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-5387

Affected Products

Jeewms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-5387 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5387 · Vendor Advisory
• https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV · Note
• https://t.me/cvetracker/25092 · Telegram Post
• https://vuldb.com/?id.310680 · Note
• https://vuldb.com/?ctiid.310680 · Note
• https://twitter.com/CVEnew/status/1928869649833402512 · Twitter Post
• https://t.me/cvenotify/124252 · Telegram Post