{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4542","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-05-10T13:48:28.434Z","datePublished":"2025-05-11T17:31:03.798Z","dateUpdated":"2025-05-12T12:37:49.407Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2025-05-11T17:31:03.798Z"},"title":"Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-942","lang":"en","description":"Permissive Cross-domain Policy with Untrusted Domains"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-346","lang":"en","description":"Origin Validation Error"}]}],"affected":[{"vendor":"Freeebird","product":"Hotel 酒店管理系统 API","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"}]}],"descriptions":[{"lang":"en","value":"A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functionality of the file /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Eine problematische Schwachstelle wurde in Freeebird Hotel 酒店管理系统 API bis 1.2 entdeckt. Betroffen davon ist ein unbekannter Prozess der Datei /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. Mit der Manipulation mit unbekannten Daten kann eine permissive cross-domain policy with untrusted domains-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Die Komplexität eines Angriffs ist eher hoch. Sie ist schwierig ausnutzbar. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":2.3,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"LOW"}},{"cvssV3_1":{"version":"3.1","baseScore":3.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.1,"vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":2.6,"vectorString":"AV:N/AC:H/Au:N/C:N/I:P/A:N"}}],"timeline":[{"time":"2025-05-10T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-05-10T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-05-10T15:53:31.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"ShenxiuSecurity (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.308288","name":"VDB-308288 | Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.308288","name":"VDB-308288 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.567214","name":"Submit #567214 | freeebird hotel 1.2 branch Permissive Cross-domain Policy with Untrusted Domains","tags":["third-party-advisory"]},{"url":"https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250429-01.md","tags":["exploit"]}]},"adp":[{"references":[{"url":"https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250429-01.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-12T12:37:46.607959Z","id":"CVE-2025-4542","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-05-12T12:37:49.407Z"}}]}}