CVE-2025-8852 | THREATINT

Description

A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Dabei betrifft es einen unbekannter Codeteil der Datei /adminFile/upload der Komponente API Response Handler. Durch das Beeinflussen mit unbekannten Daten kann eine information exposure through error message-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.

Reserved 2025-08-10 | Published 2025-08-11 | Updated 2025-08-11 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

MEDIUM: 4.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

4.0AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR

Problem types

Information Exposure Through Error Message

Information Disclosure

Product status

11.0

affected

Timeline

2025-08-10:	Advisory disclosed
2025-08-10:	VulDB entry created
2025-08-10:	VulDB entry last update

Credits

meraklbz (VulDB User) reporter

References

vuldb.com/?id.319383 (VDB-319383 | WuKongOpenSource WukongCRM API Response upload information exposure) vdb-entry

vuldb.com/?ctiid.319383 (VDB-319383 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.624693 (Submit #624693 | WuKongOpenSource WukongCRM v11.0 System Path Disclosure(CWE-209)) third-party-advisory

github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26 issue-tracking

github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26 exploit issue-tracking

cve.org (CVE-2025-8852)

nvd.nist.gov (CVE-2025-8852)

Download JSON