Search criteria

9 vulnerabilities found for jmix_framework by haulmont

CVE-2025-32952 (GCVE-0-2025-32952)

Vulnerability from nvd – Published: 2025-04-22 17:32 – Updated: 2025-05-27 17:00
VLAI?
Title
io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version
jmix-framework jmix Affected: >= 1.0.0, < 1.6.2
Affected: >= 2.0.0, < 2.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32952",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T19:56:32.907417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-25T16:03:04.176Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jmix",
          "vendor": "jmix-framework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.6.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-27T17:00:25.356Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3804",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3804"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3836",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3836"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"
        }
      ],
      "source": {
        "advisory": "GHSA-f3gv-cwwh-758m",
        "discovery": "UNKNOWN"
      },
      "title": "io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32952",
    "datePublished": "2025-04-22T17:32:11.966Z",
    "dateReserved": "2025-04-14T21:47:11.450Z",
    "dateUpdated": "2025-05-27T17:00:25.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-32950 (GCVE-0-2025-32950)

Vulnerability from nvd – Published: 2025-04-22 17:14 – Updated: 2025-05-27 17:07
VLAI?
Title
io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-35 - Path Traversal: '.../...//'
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
Vendor Product Version
jmix-framework jmix Affected: >= 1.0.0, < 1.6.2
Affected: >= 2.0.0, < 2.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T19:56:35.680766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-25T16:03:22.669Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jmix",
          "vendor": "jmix-framework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.6.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-27T17:07:11.796Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vh"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3804",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3804"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3836",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3836"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html#fix-path-traversal-in-jmix-application",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#fix-path-traversal-in-jmix-application"
        }
      ],
      "source": {
        "advisory": "GHSA-jx4g-3xqm-62vh",
        "discovery": "UNKNOWN"
      },
      "title": "io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32950",
    "datePublished": "2025-04-22T17:14:43.211Z",
    "dateReserved": "2025-04-14T21:47:11.450Z",
    "dateUpdated": "2025-05-27T17:07:11.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-32951 (GCVE-0-2025-32951)

Vulnerability from nvd – Published: 2025-04-22 17:32 – Updated: 2025-05-27 17:18
VLAI?
Title
io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
jmix-framework jmix Affected: >= 1.0.0, < 1.6.2
Affected: >= 2.0.0, < 2.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32951",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T19:56:29.979241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-25T16:02:55.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jmix",
          "vendor": "jmix-framework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.6.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-27T17:18:23.124Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3804",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3804"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3836",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3836"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"
        }
      ],
      "source": {
        "advisory": "GHSA-x27v-f838-jh93",
        "discovery": "UNKNOWN"
      },
      "title": "io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32951",
    "datePublished": "2025-04-22T17:32:23.401Z",
    "dateReserved": "2025-04-14T21:47:11.450Z",
    "dateUpdated": "2025-05-27T17:18:23.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

FKIE_CVE-2025-32952

Vulnerability from fkie_nvd - Published: 2025-04-22 18:16 - Updated: 2025-12-31 15:55
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
References
security-advisories@github.comhttps://docs.jmix.io/jmix/files-vulnerabilities.htmlVendor Advisory
security-advisories@github.comhttps://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-applicationVendor Advisory
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2Patch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6aPatch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37Patch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aaPatch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/issues/3804Issue Tracking
security-advisories@github.comhttps://github.com/jmix-framework/jmix/issues/3836Issue Tracking
security-advisories@github.comhttps://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758mPatch, Vendor Advisory
Impacted products
Vendor Product Version
haulmont cuba_platform *
haulmont cuba_rest_api *
haulmont jmix_framework *
haulmont jmix_framework *
haulmont jpa_web_api *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haulmont:cuba_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4144D951-290E-4CDD-88B0-F4052FD28B7F",
              "versionEndExcluding": "7.2.23",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:cuba_rest_api:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9943C493-5789-4D32-A280-7BA564818C8A",
              "versionEndExcluding": "7.2.7",
              "versionStartIncluding": "7.1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A877F67E-4952-4984-8F29-A5DFD0E3090A",
              "versionEndExcluding": "1.6.2",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "266AE114-6141-48C3-BCBC-33C47FBE0B89",
              "versionEndExcluding": "2.4.0",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jpa_web_api:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FCA5975A-4E12-4D55-A93B-486BC1D9F219",
              "versionEndExcluding": "1.1.1",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
    },
    {
      "lang": "es",
      "value": "Jmix es un conjunto de librer\u00edas y herramientas para acelerar el desarrollo de aplicaciones centradas en datos en Spring Boot. En las versiones 1.0.0 a 1.6.1 y 2.0.0 a 2.3.4, la implementaci\u00f3n del almacenamiento local de archivos no restringe el tama\u00f1o de los archivos subidos. Un atacante podr\u00eda aprovechar esta situaci\u00f3n subiendo archivos excesivamente grandes, lo que podr\u00eda provocar que el servidor se quede sin espacio y devuelva un error HTTP 500, lo que resulta en una denegaci\u00f3n de servicio. Este problema se ha corregido en las versiones 1.6.2 y 2.4.0. Se ofrece un workaround en el sitio web de documentaci\u00f3n de Jmix."
    }
  ],
  "id": "CVE-2025-32952",
  "lastModified": "2025-12-31T15:55:53.993",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-22T18:16:00.097",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jmix-framework/jmix/issues/3804"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jmix-framework/jmix/issues/3836"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2025-32951

Vulnerability from fkie_nvd - Published: 2025-04-22 18:15 - Updated: 2025-12-31 15:57
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
References
security-advisories@github.comhttps://docs.jmix.io/jmix/files-vulnerabilities.htmlVendor Advisory
security-advisories@github.comhttps://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-applicationVendor Advisory
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2Patch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6aPatch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37Patch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aaPatch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/issues/3804Issue Tracking
security-advisories@github.comhttps://github.com/jmix-framework/jmix/issues/3836Issue Tracking
security-advisories@github.comhttps://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93Patch, Vendor Advisory
Impacted products
Vendor Product Version
haulmont cuba_platform *
haulmont cuba_rest_api *
haulmont jmix_framework *
haulmont jmix_framework *
haulmont jpa_web_api *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haulmont:cuba_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4144D951-290E-4CDD-88B0-F4052FD28B7F",
              "versionEndExcluding": "7.2.23",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:cuba_rest_api:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9943C493-5789-4D32-A280-7BA564818C8A",
              "versionEndExcluding": "7.2.7",
              "versionStartIncluding": "7.1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A877F67E-4952-4984-8F29-A5DFD0E3090A",
              "versionEndExcluding": "1.6.2",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "266AE114-6141-48C3-BCBC-33C47FBE0B89",
              "versionEndExcluding": "2.4.0",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jpa_web_api:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FCA5975A-4E12-4D55-A93B-486BC1D9F219",
              "versionEndExcluding": "1.1.1",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
    },
    {
      "lang": "es",
      "value": "Jmix es un conjunto de librer\u00edas y herramientas para acelerar el desarrollo de aplicaciones centradas en datos en Spring Boot. En las versiones 1.0.0 a 1.6.1 y 2.0.0 a 2.3.4, el par\u00e1metro de entrada, que consiste en la ruta y el nombre del archivo, se puede manipular para devolver el encabezado Content-Type con text/html si el nombre termina en .html. Esto podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo JavaScript malicioso en el navegador. Para que un ataque tenga \u00e9xito, es necesario cargar previamente un archivo malicioso. Este problema se ha corregido en las versiones 1.6.2 y 2.4.0. Se ofrece un workaround en el sitio web de documentaci\u00f3n de Jmix."
    }
  ],
  "id": "CVE-2025-32951",
  "lastModified": "2025-12-31T15:57:34.573",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-22T18:15:59.940",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jmix-framework/jmix/issues/3804"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jmix-framework/jmix/issues/3836"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2025-32950

Vulnerability from fkie_nvd - Published: 2025-04-22 18:15 - Updated: 2025-12-31 16:04
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
References
security-advisories@github.comhttps://docs.jmix.io/jmix/files-vulnerabilities.htmlVendor Advisory
security-advisories@github.comhttps://docs.jmix.io/jmix/files-vulnerabilities.html#fix-path-traversal-in-jmix-applicationVendor Advisory
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2Patch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6aPatch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37Patch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aaPatch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/issues/3804Issue Tracking
security-advisories@github.comhttps://github.com/jmix-framework/jmix/issues/3836Issue Tracking
security-advisories@github.comhttps://github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vhVendor Advisory
Impacted products
Vendor Product Version
haulmont jmix_framework *
haulmont jmix_framework *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A877F67E-4952-4984-8F29-A5DFD0E3090A",
              "versionEndExcluding": "1.6.2",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "266AE114-6141-48C3-BCBC-33C47FBE0B89",
              "versionEndExcluding": "2.4.0",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
    },
    {
      "lang": "es",
      "value": "Jmix es un conjunto de librer\u00edas y herramientas para acelerar el desarrollo de aplicaciones centradas en datos en Spring Boot. En las versiones 1.0.0 a 1.6.1 y 2.0.0 a 2.3.4, los atacantes pod\u00edan manipular el par\u00e1metro FileRef para acceder a los archivos del sistema donde se implementa la aplicaci\u00f3n Jmix, siempre que el servidor de aplicaciones cuente con los permisos necesarios. Esto se puede lograr modificando FileRef directamente en la base de datos o proporcionando un valor da\u00f1ino en el par\u00e1metro fileRef del endpoint `/files` de la API REST gen\u00e9rica. Este problema se ha corregido en las versiones 1.6.2 y 2.4.0. Se ofrece un workaround en el sitio web de documentaci\u00f3n de Jmix."
    }
  ],
  "id": "CVE-2025-32950",
  "lastModified": "2025-12-31T16:04:29.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-22T18:15:59.793",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#fix-path-traversal-in-jmix-application"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jmix-framework/jmix/issues/3804"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jmix-framework/jmix/issues/3836"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-35"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

CVE-2025-32951 (GCVE-0-2025-32951)

Vulnerability from cvelistv5 – Published: 2025-04-22 17:32 – Updated: 2025-05-27 17:18
VLAI?
Title
io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Severity ?
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
jmix-framework jmix Affected: >= 1.0.0, < 1.6.2
Affected: >= 2.0.0, < 2.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32951",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T19:56:29.979241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-25T16:02:55.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jmix",
          "vendor": "jmix-framework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.6.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-27T17:18:23.124Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3804",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3804"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3836",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3836"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"
        }
      ],
      "source": {
        "advisory": "GHSA-x27v-f838-jh93",
        "discovery": "UNKNOWN"
      },
      "title": "io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32951",
    "datePublished": "2025-04-22T17:32:23.401Z",
    "dateReserved": "2025-04-14T21:47:11.450Z",
    "dateUpdated": "2025-05-27T17:18:23.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-32952 (GCVE-0-2025-32952)

Vulnerability from cvelistv5 – Published: 2025-04-22 17:32 – Updated: 2025-05-27 17:00
VLAI?
Title
io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version
jmix-framework jmix Affected: >= 1.0.0, < 1.6.2
Affected: >= 2.0.0, < 2.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32952",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T19:56:32.907417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-25T16:03:04.176Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jmix",
          "vendor": "jmix-framework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.6.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-27T17:00:25.356Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3804",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3804"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3836",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3836"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"
        }
      ],
      "source": {
        "advisory": "GHSA-f3gv-cwwh-758m",
        "discovery": "UNKNOWN"
      },
      "title": "io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32952",
    "datePublished": "2025-04-22T17:32:11.966Z",
    "dateReserved": "2025-04-14T21:47:11.450Z",
    "dateUpdated": "2025-05-27T17:00:25.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-32950 (GCVE-0-2025-32950)

Vulnerability from cvelistv5 – Published: 2025-04-22 17:14 – Updated: 2025-05-27 17:07
VLAI?
Title
io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-35 - Path Traversal: '.../...//'
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
Vendor Product Version
jmix-framework jmix Affected: >= 1.0.0, < 1.6.2
Affected: >= 2.0.0, < 2.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T19:56:35.680766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-25T16:03:22.669Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jmix",
          "vendor": "jmix-framework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.6.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful value in the fileRef parameter of the `/files` endpoint of the generic REST API. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-35",
              "description": "CWE-35: Path Traversal: \u0027.../...//\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-27T17:07:11.796Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-jx4g-3xqm-62vh"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3804",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3804"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/issues/3836",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/issues/3836"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
        },
        {
          "name": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
        },
        {
          "name": "https://docs.jmix.io/jmix/files-vulnerabilities.html#fix-path-traversal-in-jmix-application",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#fix-path-traversal-in-jmix-application"
        }
      ],
      "source": {
        "advisory": "GHSA-jx4g-3xqm-62vh",
        "discovery": "UNKNOWN"
      },
      "title": "io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32950",
    "datePublished": "2025-04-22T17:14:43.211Z",
    "dateReserved": "2025-04-14T21:47:11.450Z",
    "dateUpdated": "2025-05-27T17:07:11.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}