PT-2025-31876 · Unknown · Cloudfavorites Favorites-Web

Zast.Ai · Published 2025-08-04 · Updated 2025-08-05 · CVE-2025-8529

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cloudfavorites favorites-web versions up to 1.3.0

Description A critical vulnerability exists in cloudfavorites favorites-web. The getCollectLogoUrl function within the app/src/main/java/com/favorites/web/CollectController.java file is susceptible to server-side request forgery (SSRF). Manipulation of the url argument can trigger this issue, allowing for remote exploitation. The exploit has been publicly disclosed.

Recommendations Update cloudfavorites favorites-web to a version later than 1.3.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-8529

Affected Products

Cloudfavorites Favorites-Web

References · 11

• 🔥 https://github.com/cloudfavorites/favorites-web/issues/134#issue-3252105130 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8529 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8529 · Vendor Advisory
• https://github.com/cloudfavorites/favorites-web/issues/134 · Note
• https://vuldb.com/?id.318655 · Note
• https://twitter.com/VulmonFeeds/status/1952548617048182953 · Twitter Post
• https://t.me/CVEtracker/29141 · Telegram Post
• https://t.me/cveNotify/130858 · Telegram Post
• https://twitter.com/CVEnew/status/1952500630787956910 · Twitter Post
• https://vuldb.com/?submit.622176 · Note
• https://vuldb.com/?ctiid.318655 · Note