PT-2025-6862

CVE-2025-1226

Published

2025-02-12

Updated

2025-02-13

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ywoa versions up to 2024.07.03

Description A critical issue has been identified, affecting unknown code in the /oa/setup/setup.jsp file. This leads to improper authorization and can be exploited remotely. The issue has been publicly disclosed.

Recommendations For versions up to 2024.07.03, upgrade to version 2024.07.04 to address this issue. As a temporary workaround, consider restricting access to the /oa/setup/setup.jsp file until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Rabbit

Vendors

Affected products

Weakness enumeration

CWE-285: Improper Authorization

CWE-266: Incorrect Privilege Assignment

Related identifiers