VA-25-104-01

Vulnerability from csaf_cisa - Published: 2025-04-15 13:49 - Updated: 2025-04-23 00:00
Summary
SicommNet multiple vulnerabilities

Notes

Legal Notice
All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).
Countries and Areas Deployed
United States
Critical Infrastructure Sectors
Information Technology
Risk Evaluation
SicommNet BASEC is an online eProcurement solution used by governments and other entities. Multiple vulnerabilities have been found in BASEC. These vulnerabilities allow a remote, unauthenticated attacker to gain administrative privileges, read user passwords, and obtain credentials. The attacker could take complete control of BASEC and all of the user data stored in BASEC.
Recommended Practices
Contact SicommNet.
Company Headquarters Location
United States
To clipboard 

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "SicommNet BASEC is an online eProcurement solution used by governments and other entities. Multiple vulnerabilities have been found in BASEC. These vulnerabilities allow a remote, unauthenticated attacker to gain administrative privileges, read user passwords, and obtain credentials. The attacker could take complete control of BASEC and all of the user data stored in BASEC.",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "Contact SicommNet. ",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-25-104-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-104-01.json"
      }
    ],
    "title": "SicommNet multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2025-04-23T00:00:00Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.8.0"
        }
      },
      "id": "VA-25-104-01",
      "initial_release_date": "2025-04-15T13:49:55Z",
      "revision_history": [
        {
          "date": "2025-04-23T00:00:00Z",
          "number": "2.0.0",
          "summary": "Updated status for CVE-2025-22371"
        },
        {
          "date": "2025-04-15T13:49:55Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "2.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2025-04-16",
                "product": {
                  "name": "SicommNet BASEC \u003c2025-04-16",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "2025-04-16",
                "product": {
                  "name": "SicommNet BASEC 2025-04-16",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "SicommNet BASEC vers:all/*",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "BASEC"
          }
        ],
        "category": "vendor",
        "name": "SicommNet"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Frank Breedijk"
          ],
          "organization": "DIVD"
        },
        {
          "names": [
            "Jesse Meijer"
          ],
          "organization": "DIVD"
        }
      ],
      "cve": "CVE-2025-22371",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in the SicommNet BASEC (SaaS) login page allows an unauthenticated remote attacker to bypass authentication and execute arbitrary SQL commands. This issue was discovered on 2021-12-14 and fixed on 2025-04-16.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:P/A:Y/T:T/2025-04-14T15:01:58Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "basec.sicomm.net",
          "url": "https://basec.sicomm.net/"
        },
        {
          "category": "external",
          "summary": "csirt.divd.nl",
          "url": "https://csirt.divd.nl/DIVD-2025-00001"
        },
        {
          "category": "external",
          "summary": "csirt.divd.nl",
          "url": "https://csirt.divd.nl/CVE-2025-22371"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22371"
        }
      ],
      "release_date": "2025-04-14T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-04-16T04:00:00Z",
          "details": "Fixed as of 2025-04-16.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22371"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-16T04:00:00Z",
          "details": "Fixed as of 2025-04-16.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22371"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jesse Meijer"
          ],
          "organization": "DIVD"
        },
        {
          "names": [
            "Frank Breedijk"
          ],
          "organization": "DIVD"
        }
      ],
      "cve": "CVE-2025-22372",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An Insufficiently Protected Credentials vulnerability in SicommNet BASEC (SaaS) allows password recovery. Passwords are either stored in plain text or using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue was discovered on 2021-12-14.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:P/A:N/T:T/2025-04-14T15:02:49Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "basec.sicomm.net",
          "url": "https://basec.sicomm.net/login/"
        },
        {
          "category": "external",
          "summary": "csirt.divd.nl",
          "url": "https://csirt.divd.nl/DIVD-2025-00001"
        },
        {
          "category": "external",
          "summary": "csirt.divd.nl",
          "url": "https://csirt.divd.nl/CVE-2025-22372"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22372"
        }
      ],
      "release_date": "2025-04-14T00:00:00Z",
      "remediations": [
        {
          "category": "none_available",
          "date": "2025-04-14T04:00:00Z",
          "details": "Contact SicommNet.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Insecure password storage in SicommNet BASEC"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Frank Breedijk"
          ],
          "organization": "DIVD"
        },
        {
          "names": [
            "Jesse Meijer"
          ],
          "organization": "DIVD"
        }
      ],
      "cve": "CVE-2025-22373",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in SicommNet BASEC (SaaS) allows reflected XSS, XSS through HTTP query strings, rendering of arbitrary HTML, and alternation of CSS styles. This issue was discovered on 2021-12-14.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:P/A:N/T:P/2025-04-14T15:03:52Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "basec.sicomm.net",
          "url": "https://basec.sicomm.net/login/"
        },
        {
          "category": "external",
          "summary": "csirt.divd.nl",
          "url": "https://csirt.divd.nl/DIVD-2025-00001"
        },
        {
          "category": "external",
          "summary": "csirt.divd.nl",
          "url": "https://csirt.divd.nl/CVE-2025-22373"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-22373"
        }
      ],
      "release_date": "2025-04-14T00:00:00Z",
      "remediations": [
        {
          "category": "none_available",
          "date": "2025-04-14T04:00:00Z",
          "details": "Contact SicommNet.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "XSS, HTML and Style injection on login page in SicommNet BASEC"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.