CVE-2025-0390

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0390
A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKBM Exploit Issue Tracking
https://vuldb.com/?ctiid.291124 Permissions Required VDB Entry
https://vuldb.com/?id.291124 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:huayi-tec:jeewms:*:*:*:*:*:*:*:*
History

11 Sep 2025, 21:00

Type Values Removed Values Added
First Time Huayi-tec
Huayi-tec jeewms
CPE cpe:2.3:a:huayi-tec:jeewms:*:*:*:*:*:*:*:*
Summary
  • (es) Se ha encontrado una vulnerabilidad clasificada como crítica en Guangzhou Huayi Intelligent Technology Jeewms hasta 20241229. Esta vulnerabilidad afecta al código desconocido del archivo /wmOmNoticeHController.do. La manipulación conduce a la navegación por la ruta: '../filedir'. El ataque se puede iniciar de forma remota. El exploit se ha hecho público y puede utilizarse. La actualización a la versión 20250101 puede solucionar este problema. Se recomienda actualizar el componente afectado.
References () https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKBM - () https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKBM - Exploit, Issue Tracking
References () https://vuldb.com/?ctiid.291124 - () https://vuldb.com/?ctiid.291124 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.291124 - () https://vuldb.com/?id.291124 - Third Party Advisory, VDB Entry

11 Jan 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-11 08:15

Updated : 2025-09-11 21:00

NVD link : CVE-2025-0390

Mitre link : CVE-2025-0390

CVE.ORG link : CVE-2025-0390

JSON object : View

Products Affected

huayi-tec

  • jeewms
CWE
CWE-23

Relative Path Traversal

CWE-24

Path Traversal: '../filedir'