{"id":"CVE-2025-4542","state":"PUBLISHED","title":"Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy","description":"A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functionality of the file /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-05-11T17:31:03.798Z","updatedAt":"2025-05-12T12:37:49.407Z","severity":{"score":2.3,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["Freeebird Hotel 酒店管理系统 API"],"affected":[{"vendor":"Freeebird","product":"Hotel 酒店管理系统 API","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"}]}],"references":["https://vuldb.com/?id.308288","https://vuldb.com/?ctiid.308288","https://vuldb.com/?submit.567214","https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250429-01.md"],"weaknesses":["CWE-942","CWE-346"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4542.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4542","state":"PUBLISHED","datePublished":"2025-05-11T17:31:03.798Z","dateUpdated":"2025-05-12T12:37:49.407Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-05-10T13:48:28.434Z"},"containers":{"cna":{"title":"Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy","descriptions":[{"lang":"en","value":"A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functionality of the file /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Eine problematische Schwachstelle wurde in Freeebird Hotel 酒店管理系统 API bis 1.2 entdeckt. Betroffen davon ist ein unbekannter Prozess der Datei /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. Mit der Manipulation mit unbekannten Daten kann eine permissive cross-domain policy with untrusted domains-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Die Komplexität eines Angriffs ist eher hoch. Sie ist schwierig ausnutzbar. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"Freeebird","product":"Hotel 酒店管理系统 API","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.308288","name":"VDB-308288 | Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.308288","name":"VDB-308288 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.567214","name":"Submit #567214 | freeebird hotel 1.2 branch Permissive Cross-domain Policy with Untrusted Domains","tags":["third-party-advisory"]},{"url":"https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250429-01.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":2.3,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"LOW"}},{"cvssV3_1":{"version":"3.1","baseScore":3.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.1,"vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":2.6,"vectorString":"AV:N/AC:H/Au:N/C:N/I:P/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-942","type":"CWE","lang":"en","description":"Permissive Cross-domain Policy with Untrusted Domains"}]},{"descriptions":[{"cweId":"CWE-346","type":"CWE","lang":"en","description":"Origin Validation Error"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-05-11T17:31:03.798Z"},"timeline":[{"time":"2025-05-10T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-05-10T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-05-10T15:53:31.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"ShenxiuSecurity (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250429-01.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-12T12:37:46.607959Z","id":"CVE-2025-4542","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-12T12:37:49.407Z"}}]}}}