PT-2025-23972 · Shenzhen Dashi Tongzhou Information Technology · Agilebpm

Published 2025-06-05 · Updated 2025-06-05 · CVE-2025-5679

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shenzhen Dashi Tongzhou Information Technology AgileBPM versions up to 2.5.0

Description A critical issue has been discovered, affecting the parseStrByFreeMarker function in the file /src/main/java/com/dstz/sys/rest/controller/SysToolsController.java. The manipulation of the str argument leads to deserialization, allowing for a remote attack. The exploit has been publicly disclosed.

Recommendations For versions up to 2.5.0, consider disabling the parseStrByFreeMarker function as a temporary workaround until a patch is available. Restrict access to the SysToolsController.java file to minimize the risk of exploitation. Avoid using the str argument in the affected function until the issue is resolved.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-5679

Affected Products

Agilebpm

References · 8

• 🔥 https://gitee.com/agile-bpm/agile-bpm-basic/issues/ICAQWG · Exploit
• https://osv.dev/vulnerability/CVE-2025-5679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5679 · Security Note
• https://vuldb.com/?ctiid.311166 · Note
• https://vuldb.com/?id.311166 · Note
• https://t.me/cvetracker/25538 · Telegram Post
• https://vuldb.com/?submit.585127 · Note
• https://twitter.com/CVEnew/status/1930707240048058729 · Twitter Post