CVE-2025-27419

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27419

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

W

eGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing aggressive spidering. The vulnerability is caused by recursive crawling of dynamically generated URLs and insufficient handling of large volumes of requests. This vulnerability is fixed in 3.2.16.

References
Link Resource
https://github.com/LabRedesCefetRJ/WeGIA/commit/624ddfadb3fd8f8b30ad4f601b032a9bacc86a39 Patch
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9rp6-4mqp-g4p8 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
History

07 Mar 2025, 20:42

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
First Time Wegia wegia
Wegia
Summary
  • (es) WeGIA es un gestor web de código abierto para instituciones enfocado en los usuarios de lengua portuguesa. Existe una vulnerabilidad de denegación de servicio (DoS) en WeGIA. Esta vulnerabilidad permite que cualquier usuario no autenticado haga que el servidor deje de responder mediante un rastreo agresivo. La vulnerabilidad es causada por el rastreo recursivo de URL generadas dinámicamente y una gestión insuficiente de grandes volúmenes de solicitudes. Esta vulnerabilidad se corrigió en la versión 3.2.16.
References () https://github.com/LabRedesCefetRJ/WeGIA/commit/624ddfadb3fd8f8b30ad4f601b032a9bacc86a39 - () https://github.com/LabRedesCefetRJ/WeGIA/commit/624ddfadb3fd8f8b30ad4f601b032a9bacc86a39 - Patch
References () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9rp6-4mqp-g4p8 - () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9rp6-4mqp-g4p8 - Exploit, Vendor Advisory

03 Mar 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-03 16:15

Updated : 2025-03-07 20:42

NVD link : CVE-2025-27419

Mitre link : CVE-2025-27419

CVE.ORG link : CVE-2025-27419

JSON object : View

Products Affected

wegia

CWE
CWE-770

Allocation of Resources Without Limits or Throttling