CVE-2025-31119

{"id": "CVE-2025-31119", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}]}, "published": "2025-04-03T20:15:25.223", "references": [{"url": "https://github.com/jhipster/generator-jhipster-entity-audit/blob/e21e83135d10c77d92203c89cb0b0063914e8fe0/generators/spring-boot-javers/templates/src/main/java/_package_/web/rest/JaversEntityAuditResource.java.ejs#L88", "source": "[email protected]"}, {"url": "https://github.com/jhipster/generator-jhipster-entity-audit/security/advisories/GHSA-7rmp-3g9f-cvq8", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-470"}]}], "descriptions": [{"lang": "en", "value": "generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1."}, {"lang": "es", "value": "generator-jhipster-entity-audit es un m\u00f3dulo de JHipster que habilita la auditor\u00eda de entidades y la p\u00e1gina de registro de auditor\u00eda. En versiones anteriores a la versi\u00f3n 5.9.1, generator-jhipster-entity-audit permit\u00eda la reflexi\u00f3n insegura al seleccionar Javers como marco de auditor\u00eda de entidades. Si un atacante logra insertar clases maliciosas en la ruta de clases y, adem\u00e1s, tiene acceso a estas interfaces REST para llamar a los endpoints REST mencionados, el uso de estas l\u00edneas de c\u00f3digo puede provocar la ejecuci\u00f3n remota no intencionada de c\u00f3digo. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 5.9.1."}], "lastModified": "2025-04-07T14:18:34.453", "sourceIdentifier": "[email protected]"}