CVE-2025-25036 - Vulnerability Details - OpenCVE

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Jalios	Jcms

No data.

No data.

References

Link	Providers
https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19
https://issues.jalios.com/browse/JCMS-11250
https://vulncheck.com/advisories/jalios-jplatform-xxe

History

Wed, 19 Nov 2025 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jalios Jalios jcms
CPEs		cpe:2.3:a:jalios:jcms::::::::
Vendors & Products		Jalios Jalios jcms

Fri, 21 Mar 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 21 Mar 2025 19:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).
Title		Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)
Weaknesses		CWE-611
References		https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19 https://issues.jalios.com/browse/JCMS-11250 https://vulncheck.com/advisories/jalios-jplatform-xxe
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2025-03-21T19:27:12.472Z

Updated: 2025-11-19T20:26:50.070Z

Reserved: 2025-01-31T18:32:36.214Z

Link: CVE-2025-25036

Vulnrichment

Updated: 2025-03-21T19:49:55.887Z

NVD

Status : Received

Published: 2025-03-21T20:15:15.293

Modified: 2025-03-21T20:15:15.293

Link: CVE-2025-25036

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-25036", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-01-31T18:32:36.214Z", "datePublished": "2025-03-21T19:27:12.472Z", "dateUpdated": "2025-11-19T20:26:50.070Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "JPlatform", "vendor": "Jalios", "versions": [{"lessThan": "10.0.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jalios:jcms:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.0.8", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Arthur Deloffre (Vozec)"}, {"lang": "en", "type": "finder", "value": "Tristan Bizien (Bizi)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.<p>This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).</p>"}], "value": "Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8)."}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-11-19T20:26:50.070Z"}, "references": [{"url": "https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19"}, {"url": "https://issues.jalios.com/browse/JCMS-11250"}, {"url": "https://vulncheck.com/advisories/jalios-jplatform-xxe"}], "source": {"discovery": "UNKNOWN"}, "title": "Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)", "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-21T19:49:39.974923Z", "id": "CVE-2025-25036", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T19:50:06.001Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-25036", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-21T19:49:39.974923Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T19:49:55.887Z"}}], "cna": {"title": "Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Arthur Deloffre (Vozec)"}, {"lang": "en", "type": "finder", "value": "Tristan Bizien (Bizi)"}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Jalios", "product": "JPlatform", "versions": [{"status": "affected", "version": "0", "lessThan": "10.0.8", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19"}, {"url": "https://issues.jalios.com/browse/JCMS-11250"}, {"url": "https://vulncheck.com/advisories/jalios-jplatform-xxe"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).", "supportingMedia": [{"type": "text/html", "value": "Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.<p>This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-03-21T19:38:28.232Z"}}}, "cveMetadata": {"cveId": "CVE-2025-25036", "state": "PUBLISHED", "dateUpdated": "2025-03-21T19:50:06.001Z", "dateReserved": "2025-01-31T18:32:36.214Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-03-21T19:27:12.472Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.1"}