{"id":"CVE-2025-10247","state":"PUBLISHED","title":"JEPaaS Filter doFilterInternal access control","description":"A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-09-11T05:32:06.216Z","updatedAt":"2025-09-11T14:42:14.299Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["n/a JEPaaS"],"affected":[{"vendor":"n/a","product":"JEPaaS","versions":[{"version":"7.2.8","status":"affected"}],"modules":["Filter Handler"]}],"references":["https://vuldb.com/?id.323547","https://vuldb.com/?ctiid.323547","https://vuldb.com/?submit.642413","https://github.com/c3p0ooo-Yiqiyin/JEPaaS-Access-control-bypass-vulnerability/blob/main/README.md"],"weaknesses":["CWE-284","CWE-266"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/10xxx/CVE-2025-10247.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-10247","state":"PUBLISHED","datePublished":"2025-09-11T05:32:06.216Z","dateUpdated":"2025-09-11T14:42:14.299Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-09-10T19:10:35.629Z"},"containers":{"cna":{"title":"JEPaaS Filter doFilterInternal access control","descriptions":[{"lang":"en","value":"A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"In JEPaaS 7.2.8 ist eine Schwachstelle entdeckt worden. Betroffen ist die Funktion doFilterInternal der Komponente Filter Handler. Durch das Manipulieren mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Ein Angriff ist aus der Distanz möglich. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden."}],"affected":[{"vendor":"n/a","product":"JEPaaS","versions":[{"version":"7.2.8","status":"affected"}],"modules":["Filter Handler"]}],"references":[{"url":"https://vuldb.com/?id.323547","name":"VDB-323547 | JEPaaS Filter doFilterInternal access control","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.323547","name":"VDB-323547 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.642413","name":"Submit #642413 | JEPaaS v7.2.8 Access Control Check Implemented After Asset is Accessed","tags":["third-party-advisory"]},{"url":"https://github.com/c3p0ooo-Yiqiyin/JEPaaS-Access-control-bypass-vulnerability/blob/main/README.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-09-11T05:32:06.216Z"},"timeline":[{"time":"2025-09-10T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-09-10T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-09-10T21:15:48.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"c3p0ooo_Yiqiyin (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-11T14:25:30.393497Z","id":"CVE-2025-10247","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-11T14:42:14.299Z"}}]}}}