Vulnerability-Lookup

GHSA-R2F7-W5VX-9JGX

Vulnerability from github – Published: 2025-08-10 15:30 – Updated: 2025-08-10 15:30

Details

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as edb14ff13e9e05394960ba46c3d31d844ff2deac. It is recommended to apply a patch to fix this issue.

Severity

3.5 (Low)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

2.0 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-8813"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-10T15:15:25Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as edb14ff13e9e05394960ba46c3d31d844ff2deac. It is recommended to apply a patch to fix this issue.",
  "id": "GHSA-r2f7-w5vx-9jgx",
  "modified": "2025-08-10T15:30:23Z",
  "published": "2025-08-10T15:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8813"
    },
    {
      "type": "WEB",
      "url": "https://github.com/atjiu/pybbs/issues/210"
    },
    {
      "type": "WEB",
      "url": "https://github.com/atjiu/pybbs/issues/210#issue-3256474679"
    },
    {
      "type": "WEB",
      "url": "https://github.com/atjiu/pybbs/issues/210#issuecomment-3134906856"
    },
    {
      "type": "WEB",
      "url": "https://github.com/atjiu/pybbs/commit/edb14ff13e9e05394960ba46c3d31d844ff2deac"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.319342"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.319342"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.622333"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2025-8813 (GCVE-0-2025-8813)

Vulnerability from cvelistv5 – Published: 2025-08-10 14:32 – Updated: 2025-08-12 19:17

Title

atjiu pybbs IndexController.java changeLanguage redirect

Summary

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-12 19:16 UTC

CWE

CWE-601 - Open Redirect

Assigner

VulDB mitre root

References

7 references

URL	Tags
https://vuldb.com/?id.319342	vdb-entrytechnical-description
https://vuldb.com/?ctiid.319342	signaturepermissions-required
https://vuldb.com/?submit.622333	third-party-advisory
https://github.com/atjiu/pybbs/issues/210	issue-tracking
https://github.com/atjiu/pybbs/issues/210#issueco…	issue-tracking
https://github.com/atjiu/pybbs/issues/210#issue-3…	exploitissue-tracking
https://github.com/atjiu/pybbs/commit/edb14ff13e9…	patch

Impacted products

1 product

Vendor	Product	Version
atjiu	pybbs	Affected: 6.0

Credits

ZAST.AI (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8813",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-12T19:16:59.605013Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T19:17:04.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/atjiu/pybbs/issues/210#issue-3256474679"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/atjiu/pybbs/issues/210#issuecomment-3134906856"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/atjiu/pybbs/issues/210"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pybbs",
          "vendor": "atjiu",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ZAST.AI (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as edb14ff13e9e05394960ba46c3d31d844ff2deac. It is recommended to apply a patch to fix this issue."
        },
        {
          "lang": "de",
          "value": "In atjiu pybbs bis 6.0.0 wurde eine problematische Schwachstelle gefunden. Betroffen ist die Funktion changeLanguage der Datei src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. Dank Manipulation des Arguments referer mit unbekannten Daten kann eine open redirect-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als edb14ff13e9e05394960ba46c3d31d844ff2deac bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "Open Redirect",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-10T14:32:06.046Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-319342 | atjiu pybbs IndexController.java changeLanguage redirect",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.319342"
        },
        {
          "name": "VDB-319342 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.319342"
        },
        {
          "name": "Submit #622333 | atjiu https://github.com/atjiu/pybbs  \u003c=6.0.0 Open Redirect",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.622333"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/atjiu/pybbs/issues/210"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/atjiu/pybbs/issues/210#issuecomment-3134906856"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/atjiu/pybbs/issues/210#issue-3256474679"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/atjiu/pybbs/commit/edb14ff13e9e05394960ba46c3d31d844ff2deac"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-08-09T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-08-09T14:40:30.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "atjiu pybbs IndexController.java changeLanguage redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-8813",
    "datePublished": "2025-08-10T14:32:06.046Z",
    "dateReserved": "2025-08-09T12:35:21.968Z",
    "dateUpdated": "2025-08-12T19:17:04.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-R2F7-W5VX-9JGX

CVE-2025-8813 (GCVE-0-2025-8813)

Tags

Sightings

Nomenclature

Related by attack behaviour