PT-2025-6862 · Ywoa · Ywoa

Rabbit · Published 2025-02-12 · Updated 2025-02-13 · CVE-2025-1226

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ywoa versions up to 2024.07.03

Description A critical issue has been identified, affecting unknown code in the /oa/setup/setup.jsp file. This leads to improper authorization and can be exploited remotely. The issue has been publicly disclosed.

Recommendations For versions up to 2024.07.03, upgrade to version 2024.07.04 to address this issue. As a temporary workaround, consider restricting access to the /oa/setup/setup.jsp file until the update is applied.

Exploit

Fix

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-266

CWE-285

Related Identifiers

CVE-2025-1226

Affected Products

Ywoa

References · 7

• 🔥 https://gitee.com/r1bbit/yimioa/issues/IBI7PG · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1226 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1226 · Vendor Advisory
• https://vuldb.com/?id.295216 · Note
• https://twitter.com/CVEnew/status/1889784908346016207 · Twitter Post
• https://vuldb.com/?ctiid.295216 · Note
• https://twitter.com/CVETracker/status/1890129054516367390 · Twitter Post