PT-2025-5973 · Janto · Janto

Guzmán Fernández Ocaña · Published 2025-02-07 · Updated 2025-02-07 · CVE-2025-1108

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Janto versions prior to r12

Description The issue concerns an insufficient data authenticity verification vulnerability. This vulnerability allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the issue, the attacker must create a POST request by injecting malicious content into the Xml parameter on the "/public/cgi/Gateway.php" endpoint.

Recommendations For versions prior to r12, as a temporary workaround, consider restricting access to the "/public/cgi/Gateway.php" endpoint to minimize the risk of exploitation. Avoid using the Xml parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2025-1108

Affected Products

Janto

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-1108 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto · Note
• https://twitter.com/VulmonFeeds/status/1887959605436658154 · Twitter Post
• https://twitter.com/CVEnew/status/1887861438984921109 · Twitter Post
• https://t.me/cvedetector/17490 · Telegram Post