PT-2025-5613 · Unknown · Activity Log Winterlock

Kenji Yoshikawa · Published 2025-02-04 · Updated 2025-02-04 · CVE-2025-24982

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Activity Log WinterLock versions prior to 1.2.5

Description: A cross-site request forgery issue exists. If a user views a malicious page while logged in, the log data may be deleted.

Recommendations: For versions prior to 1.2.5, update to version 1.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the log data until the update is applied. Avoid using the software while logged in and viewing untrusted pages to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-24982

Affected Products

Activity Log Winterlock

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-24982 · Security Note
• https://wordpress.org/plugins/winterlock · Note
• https://twitter.com/CVEnew/status/1886638344794255370 · Twitter Post
• https://t.me/cvenotify/109796 · Telegram Post
• https://t.me/cvedetector/17155 · Telegram Post
• https://jvn.jp/en/jp/JVN94806805 · Note