PT-2025-27359 · Esapi+3 · Esapi+3

Longlong Gong + 1 · Published 2025-06-29 · Updated 2026-04-16 · CVE-2025-5878

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: ESAPI esapi-java-legacy versions prior to 2.7.0.0

Description: A vulnerability was found in the interface Encoder.encodeForSQL of the SQL Injection Defense, leading to an improper neutralization of special elements. The attack may be initiated remotely. This issue affects the SQL Injection Defense, allowing for potential exploitation. The project handled the issue professionally after being contacted.

Recommendations: For versions prior to 2.7.0.0, upgrade to version 2.7.0.0 to address this issue. As a temporary workaround, consider disabling the Encoder.encodeForSQL interface until the update is applied.

Fix

RCE

Weakness Enumeration

CWE-138

CWE-20

Related Identifiers

CVE-2025-5878

DLA-4246-1

USN-8181-1

Affected Products

Debian

Esapi

Linuxmint

Ubuntu

References · 26

• https://github.com/ESAPI/esapi-java-legacy/commit/f75ac2c2647a81d2cfbdc9c899f8719c240ed512 · Patch
• https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.7.0.0 · Patch
• https://github.com/ESAPI/esapi-java-legacy/commit/e2322914304d9b1c52523ff24be495b7832f6a56 · Patch
• https://ubuntu.com/security/CVE-2022-23457 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-5878 · Security Note
• https://ubuntu.com/security/CVE-2022-24891 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-5878 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-5878 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8181-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8181-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-5878 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5878 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4246-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5878 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5878 · Vendor Advisory