PT-2025-47590 · Basis · Basis Bbj

Published 2025-11-20 · Updated 2025-11-21 · CVE-2025-34320

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BASIS BBj versions prior to 25.00

Description BASIS BBj versions prior to 25.00 have a Jetty-served web endpoint that does not properly validate or canonicalize input path segments. This allows unauthenticated directory traversal, potentially enabling the reading of arbitrary system files accessible to the account running the service. Retrieved configuration artifacts may contain account credentials used for BBj Enterprise Manager, which could grant administrative access and allow the execution of system commands under the service account. Access to other sensitive files on the host, including operating system or application data, may also be possible, potentially exposing confidential information.

Recommendations Update BASIS BBj to version 25.00 or later.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-34320

Affected Products

Basis Bbj

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-34320 · Security Note
• https://t.me/CVEtracker/37833 · Telegram Post
• https://myemail.constantcontact.com/BASIS-International-Ltd--releases-BBj---the-Barista--Application-Framework--and-AddonSoftware--by-Barista-version-25-00.html?soid=1103463119019&aid=WbfWkReLRVE · Patch, Vendor Advisory
• https://twitter.com/0dayPublishing/status/1991531974960238721 · Twitter Post
• https://twitter.com/CVEnew/status/1991535336665821665 · Twitter Post
• https://vulncheck.com/advisories/basis-bbj-unauthenticated-arbitrary-file-read-rce · Note
• https://twitter.com/CCBalert/status/1991887202968547574 · Twitter Post