PT-2025-47111 · Chunghwa Telecom · Tenderdoctransfer

Published 2025-11-17 · Updated 2025-12-19 · CVE-2025-13283

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Chunghwa Telecom TenderDocTransfer (affected versions not specified)

Description The application establishes a local web server and offers APIs for communication. A lack of CSRF protection in the APIs allows unauthenticated remote attackers to execute actions through phishing. An Absolute Path Traversal vulnerability exists within one of the APIs, enabling attackers to copy arbitrary files from the user's system and paste them into any location. This could lead to information disclosure or excessive hard drive usage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-36

CWE-352

Related Identifiers

CVE-2025-13283

Affected Products

Tenderdoctransfer

References · 11

• https://osv.dev/vulnerability/CVE-2025-13283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13283 · Security Note
• https://twitter.com/cracbot/status/1991823966768640318 · Twitter Post
• https://t.me/cveNotify/142969 · Telegram Post
• https://twitter.com/cracbot/status/1992186340159730021 · Twitter Post
• https://t.me/cveNotify/146354 · Telegram Post
• https://twcert.org.tw/tw/cp-132-10510-3719c-1.html · Note
• https://twitter.com/offseq/status/1990276616488980497 · Twitter Post
• https://twitter.com/CVEnew/status/1990265514376011851 · Twitter Post
• https://t.me/CVEtracker/37466 · Telegram Post
• https://twcert.org.tw/en/cp-139-10511-10f3a-2.html · Note