PT-2025-13030
CVE-2025-2835
·
Published
2025-03-27
·
Updated
2025-03-27
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
zhangyd-c OneBlog versions up to 2.3.9
Description
A vulnerability was found in the function
autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched remotely.Recommendations
For versions up to 2.3.9, as a temporary workaround, consider disabling the
autoLink function until a patch is available. Restrict access to the RestApiController.java file to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾