Vulnerability-Lookup

GHSA-24XJ-R6RG-2W25

Vulnerability from github – Published: 2025-02-07 15:32 – Updated: 2025-02-07 15:32

Details

Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’.

Severity ?

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-1107"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-07T14:15:48Z",
    "severity": "CRITICAL"
  },
  "details": "Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user\u0027s password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint \u2018/public/cgi/Gateway.php\u2019.",
  "id": "GHSA-24xj-r6rg-2w25",
  "modified": "2025-02-07T15:32:38Z",
  "published": "2025-02-07T15:32:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1107"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-1107 (GCVE-0-2025-1107)

Vulnerability from cvelistv5 – Published: 2025-02-07 13:38 – Updated: 2025-02-12 20:51

Title

Unverified password change vulnerability in Janto

Summary

Severity ?

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

CWE

CWE-620 - Unverified Password Change

Assigner

INCIBE

References

URL

Tags

https://www.incibe.es/en/incibe-cert/notices/avis…

Impacted products

	Vendor	Product	Version
	Impronta	Janto	Affected: 0 , < r12 (custom)

Credits

Guzmán Fernández Ocaña

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1107",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-07T14:32:00.929994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T20:51:40.689Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Janto",
          "vendor": "Impronta",
          "versions": [
            {
              "lessThan": "r12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Guzm\u00e1n Fern\u00e1ndez Oca\u00f1a"
        }
      ],
      "datePublic": "2025-02-07T11:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user\u0027s password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint \u2018/public/cgi/Gateway.php\u2019."
            }
          ],
          "value": "Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user\u0027s password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint \u2018/public/cgi/Gateway.php\u2019."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-620",
              "description": "CWE-620: Unverified Password Change",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-07T13:38:56.844Z",
        "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
        "shortName": "INCIBE"
      },
      "references": [
        {
          "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "With the implemented patches by the Impronta team, the detected vulnerabilities have been fixed. All customers using this product in SaaS mode have been upgraded to version r12 which fixes these issues."
            }
          ],
          "value": "With the implemented patches by the Impronta team, the detected vulnerabilities have been fixed. All customers using this product in SaaS mode have been upgraded to version r12 which fixes these issues."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unverified password change vulnerability in Janto",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
    "assignerShortName": "INCIBE",
    "cveId": "CVE-2025-1107",
    "datePublished": "2025-02-07T13:38:40.967Z",
    "dateReserved": "2025-02-07T12:01:26.834Z",
    "dateUpdated": "2025-02-12T20:51:40.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-24XJ-R6RG-2W25

CVE-2025-1107 (GCVE-0-2025-1107)

Tags

Sightings

Nomenclature