VDB-312578 · CVE-2025-6109 · EUVD-2025-18365

javahongxi whatsmars 2021.4.0 InitializrController.java initialize artifactId Dafiyar fayil ɗin cikin kundin ajiyar bayanai

Hakika vulnerability da aka rarraba a matsayin kura an gano a javahongxi whatsmars 2021.4.0. Tabbas, aikin initialize ne ke da matsala; idan ba a bayyana ba, to aiki ce da ba a sani ba, a cikin laburare $software_library, a cikin fayil /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java, a cikin sashi $software_component. Wuro manipulation of the argument artifactId ga Dafiyar fayil ɗin cikin kundin ajiyar bayanai. Amfani da CWE wajen bayyana matsala yana kaiwa CWE-22. Lalle, rauni an sanar da shi 06/15/2025. Ana samun bayanin tsaro don saukewa a github.com. Ana kiran wannan rauni da CVE-2025-6109. Ngam yiɗi ka a tuma ndiyam ka nder layi. Bayani na fasaha ga. Kuma, akwai exploit. Exploit ɗin an bayyana wa jama'a, za a iya amfani da shi. Yimbe ndiyam, exploit might be approx. USD $0-$5k wuro. Á yí huɗɗi-na-gaskiya. Za a iya samun exploit a github.com. 0-day ga, an ndiyam a wuro be $0-$5k. If you want to get best quality of vulnerability data, you may have to visit VulDB.

4 Goyarwa · 90 Datenpunkte

Furɗe	Súgá 06/15/2025 12:02	Gargadi 1/3 06/16/2025 08:38	Gargadi 2/3 06/16/2025 10:06	Gargadi 3/3 06/16/2025 10:24
cvss2_vuldb_ai	N	N	N	N
cvss2_vuldb_e	POC	POC	POC	POC
cvss2_vuldb_rc	UR	UR	UR	UR
cvss4_vuldb_av	N	N	N	N
cvss4_vuldb_ac	L	L	L	L
cvss4_vuldb_ui	N	N	N	N
cvss4_vuldb_vc	L	L	L	L
cvss4_vuldb_vi	N	N	N	N
cvss4_vuldb_va	N	N	N	N
cvss4_vuldb_e	P	P	P	P
cvss2_vuldb_au	S	S	S	S
cvss2_vuldb_rl	ND	ND	ND	ND
cvss3_vuldb_pr	L	L	L	L
cvss3_vuldb_rl	X	X	X	X
cvss4_vuldb_at	N	N	N	N
cvss4_vuldb_pr	L	L	L	L
cvss4_vuldb_sc	N	N	N	N
cvss4_vuldb_si	N	N	N	N
cvss4_vuldb_sa	N	N	N	N
cvss2_vuldb_basescore	4.0	4.0	4.0	4.0
cvss2_vuldb_tempscore	3.4	3.4	3.4	3.4
cvss3_vuldb_basescore	4.3	4.3	4.3	4.3
cvss3_vuldb_tempscore	3.9	3.9	3.9	3.9
cvss3_meta_basescore	4.3	4.3	4.3	4.3
cvss3_meta_tempscore	3.9	4.1	4.1	4.1
cvss4_vuldb_bscore	5.3	5.3	5.3	5.3
cvss4_vuldb_btscore	2.1	2.1	2.1	2.1
advisory_date	1749938400 (06/15/2025)	1749938400 (06/15/2025)	1749938400 (06/15/2025)	1749938400 (06/15/2025)
price_0day	$0-$5k	$0-$5k	$0-$5k	$0-$5k
software_vendor	javahongxi	javahongxi	javahongxi	javahongxi
software_name	whatsmars	whatsmars	whatsmars	whatsmars
software_version	2021.4.0	2021.4.0	2021.4.0	2021.4.0
software_file	/whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java	/whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java	/whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java	/whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java
software_function	initialize	initialize	initialize	initialize
software_argument	artifactId	artifactId	artifactId	artifactId
vulnerability_cwe	CWE-22 (Dafiyar fayil ɗin cikin kundin ajiyar bayanai)	CWE-22 (Dafiyar fayil ɗin cikin kundin ajiyar bayanai)	CWE-22 (Dafiyar fayil ɗin cikin kundin ajiyar bayanai)	CWE-22 (Dafiyar fayil ɗin cikin kundin ajiyar bayanai)
vulnerability_risk	2	2	2	2
cvss3_vuldb_av	N	N	N	N
cvss3_vuldb_ac	L	L	L	L
cvss3_vuldb_ui	N	N	N	N
cvss3_vuldb_s	U	U	U	U
cvss3_vuldb_c	L	L	L	L
cvss3_vuldb_i	N	N	N	N
cvss3_vuldb_a	N	N	N	N
cvss3_vuldb_e	P	P	P	P
cvss3_vuldb_rc	R	R	R	R
advisory_url	https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md	https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md	https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md	https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md
exploit_availability	1	1	1	1
exploit_publicity	1	1	1	1
exploit_url	https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md#steps-to-reproduce	https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md#steps-to-reproduce	https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md#steps-to-reproduce	https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md#steps-to-reproduce
source_cve	CVE-2025-6109	CVE-2025-6109	CVE-2025-6109	CVE-2025-6109
cna_responsible	VulDB	VulDB	VulDB	VulDB
response_summary	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.
software_type	Programming Language Software	Programming Language Software	Programming Language Software	Programming Language Software
cvss2_vuldb_av	N	N	N	N
cvss2_vuldb_ac	L	L	L	L
cvss2_vuldb_ci	P	P	P	P
cvss2_vuldb_ii	N	N	N	N
cve_nvd_summary		A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java. The manipulation of the argument artifactId leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java. The manipulation of the argument artifactId leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java. The manipulation of the argument artifactId leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
cvss4_cna_av		N	N	N
cvss4_cna_ac		L	L	L
cvss4_cna_at		N	N	N
cvss4_cna_pr		L	L	L
cvss4_cna_ui		N	N	N
cvss4_cna_vc		L	L	L
cvss4_cna_vi		N	N	N
cvss4_cna_va		N	N	N
cvss4_cna_sc		N	N	N
cvss4_cna_si		N	N	N
cvss4_cna_sa		N	N	N
cvss4_cna_bscore		5.3	5.3	5.3
cvss3_cna_av		N	N	N
cvss3_cna_ac		L	L	L
cvss3_cna_pr		L	L	L
cvss3_cna_ui		N	N	N
cvss3_cna_s		U	U	U
cvss3_cna_c		L	L	L
cvss3_cna_i		N	N	N
cvss3_cna_a		N	N	N
cvss3_cna_basescore		4.3	4.3	4.3
cvss2_cna_av		N	N	N
cvss2_cna_ac		L	L	L
cvss2_cna_au		S	S	S
cvss2_cna_ci		P	P	P
cvss2_cna_ii		N	N	N
cvss2_cna_ai		N	N	N
cvss2_cna_basescore		4	4	4
euvd_id			EUVD-2025-18365	EUVD-2025-18365
cve_nvd_summaryes				Se encontró una vulnerabilidad en javahongxi whatsmars 2021.4.0. Se ha clasificado como problemática. Este problema afecta a la función initialize del archivo /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java. La manipulación del argumento artifactId provoca un path traversal. El ataque puede ejecutarse en remoto. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación sobre esta divulgación, pero no respondió.

◂ Gurɗo Gumti Gada ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!