{"id":"CVE-2025-5428","state":"PUBLISHED","title":"juzaweb CMS Error Logs Page log-viewer access control","description":"A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the component Error Logs Page. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-06-02T04:00:18.636Z","updatedAt":"2025-06-02T13:09:06.877Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["juzaweb CMS"],"affected":[{"vendor":"juzaweb","product":"CMS","versions":[{"version":"3.4.0","status":"affected"},{"version":"3.4.1","status":"affected"},{"version":"3.4.2","status":"affected"}],"modules":["Error Logs Page"]}],"references":["https://vuldb.com/?id.310761","https://vuldb.com/?ctiid.310761","https://vuldb.com/?submit.584056","https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_unprivileged_user_list_delete_logs.md"],"weaknesses":["CWE-284","CWE-266"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/5xxx/CVE-2025-5428.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-5428","state":"PUBLISHED","datePublished":"2025-06-02T04:00:18.636Z","dateUpdated":"2025-06-02T13:09:06.877Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-06-01T10:48:05.622Z"},"containers":{"cna":{"title":"juzaweb CMS Error Logs Page log-viewer access control","descriptions":[{"lang":"en","value":"A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the component Error Logs Page. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Es wurde eine Schwachstelle in juzaweb CMS bis 3.4.2 entdeckt. Sie wurde als kritisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Datei /admin-cp/log-viewer der Komponente Error Logs Page. Dank der Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"juzaweb","product":"CMS","versions":[{"version":"3.4.0","status":"affected"},{"version":"3.4.1","status":"affected"},{"version":"3.4.2","status":"affected"}],"modules":["Error Logs Page"]}],"references":[{"url":"https://vuldb.com/?id.310761","name":"VDB-310761 | juzaweb CMS Error Logs Page log-viewer access control","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.310761","name":"VDB-310761 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.584056","name":"Submit #584056 | Juzaweb  Juzaweb CMS 3.4.2 Broken Access Control on “Error Logs\" Page","tags":["third-party-advisory"]},{"url":"https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_unprivileged_user_list_delete_logs.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-06-02T04:00:18.636Z"},"timeline":[{"time":"2025-06-01T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-06-01T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-06-01T12:53:25.000Z","lang":"en","value":"VulDB entry last update"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_unprivileged_user_list_delete_logs.md","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-02T13:09:04.406159Z","id":"CVE-2025-5428","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-02T13:09:06.877Z"}}]}}}