PT-2025-5972 · Janto · Janto

Guzmán Fernández Ocaña · Published 2025-02-07 · Updated 2025-02-07 · CVE-2025-1107

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Janto versions prior to r12

Description The issue allows an unauthenticated attacker to change another user's password without knowing their current password. To exploit this, the attacker must create a specific POST request and send it to the endpoint /public/cgi/Gateway.php.

Recommendations For versions prior to r12, update to version r12 or later to resolve the issue. As a temporary workaround, consider restricting access to the /public/cgi/Gateway.php endpoint to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-1107

Affected Products

Janto

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-1107 · Security Note
• https://twitter.com/CVEnew/status/1887861439945408729 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887962165400719860 · Twitter Post
• https://t.me/cvedetector/17491 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto · Note