PT-2025-29823

CVE-2025-34300

Publicado

2025-04-09

Atualizado

2025-09-15

Descrição por

CVSS 4.0

Crítica

MétricasAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Sawtooth Lighthouse Studio versions prior to 9.16.14

Description A template injection vulnerability exists in the Perl web application ciwweb.pl within Sawtooth Lighthouse Studio, allowing unauthenticated attackers to execute arbitrary commands. Approximately 480 services are potentially affected worldwide.

Recommendations Update Sawtooth Lighthouse Studio to version 9.16.14 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Adam Kues

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-20: Improper Input Validation

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine