PT-2025-3861

CVE-2025-0390

Published

2025-01-11

Updated

2025-01-11

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Guangzhou Huayi Intelligent Technology Jeewms versions up to 20241229

Description A critical issue was found in the software, affecting the file /wmOmNoticeHController.do, which allows for path traversal using '../filedir'. This can be exploited remotely. The issue has been publicly disclosed and may be used for attacks.

Recommendations For versions up to 20241229, upgrade to version 20250101 to address this issue. As a temporary workaround, consider restricting access to the /wmOmNoticeHController.do file until the upgrade is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Rabbit

Vendors

Affected products

Weakness enumeration

CWE-23: Relative Path Traversal

CWE-24: Path Traversal: \'../filedir\'

Related identifiers