PT-2025-44196 · Bessystem · Application Server

Published 2025-10-28 · Updated 2025-10-28 · CVE-2025-60805

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BESSystem BES Application Server versions through 9.5.x

Description An issue exists that could allow unauthorized attackers to obtain sensitive information. This is due to the “pre-resource” option within the bes-web.xml file.

Recommendations Versions through 9.5.x should be updated.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-60805

Affected Products

Application Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-60805 · Security Note
• https://twitter.com/VulmonFeeds/status/1983269327282254203 · Twitter Post
• https://twitter.com/CVEnew/status/1983230068114833543 · Twitter Post
• http://bessystem.com/appserver/dtds/bes-web-app_2_5-0.dtd · Note
• https://t.me/CVEtracker/35988 · Telegram Post
• https://gist.github.com/Liu2000622/7a6294f7421ef50c378a456ca9494714 · Note
• https://bessystem.com/product/0ad9b8c4d6af462b8d15723a5f25a87d/info?p=101 · Note
• http://bes.com · Note