PT-2025-33693 · Apache+1 · Apache Commons Ognl+1

Yyjlf · Published 2025-08-18 · Updated 2025-10-28 · CVE-2025-53192

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Commons OGNL (affected versions not specified)

Description: An improper neutralization of expression/command delimiters issue exists in Apache Commons OGNL. The OGNL engine, when used with the Ognl.getValue API, parses and evaluates expressions, offering capabilities like method access and invocation. Existing restrictions attempting to block dangerous classes and methods are not comprehensive, potentially allowing attackers to bypass them using uncovered class objects and achieve arbitrary code execution.

Recommendations: As this project is retired and no fix is planned, users are recommended to find an alternative or restrict access to the instance to trusted users.

Fix

Weakness Enumeration

CWE-146

Related Identifiers

CVE-2025-53192

OPENSUSE-SU-2025:15567-1

OPENSUSE-SU-2025:15568-1

SUSE-SU-2025:03285-1

SUSE-SU-2025:3825-1

SUSE-SU-2025:3827-1

SUSE-SU-2025:3839-1

Affected Products

Apache Commons Ognl

Debian

References · 51

• https://osv.dev/vulnerability/openSUSE-SU-2025:15568-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3827-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-53192 · Security Note
• https://ubuntu.com/security/CVE-2025-53192 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3825-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53192 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-53192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53192 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3839-1 · Vendor Advisory
• https://lists.apache.org/thread/2gj8tjl6vz949nnp3yxz3okm9xz2k7sp · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15567-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53192 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03285-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-53192 · Vendor Advisory
• https://suse.com/support/update/announcement/2025/suse-su-20253827-1 · Note