CVE-2025-2395

March 17, 2025, 6:15 a.m.

9.8
Critical

Description

The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator.

Product(s) Impacted

Vendor Product Versions
E-excellence
  • U-office Force
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-565
Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a e-excellence u-office_force / / / / / / / /

References

https://www.twcert.org.tw/en/cp-139-10012-d5bbc-2.html
https://www.twcert.org.tw/tw/cp-132-10011-3de72-1.html

Tags

twcert@cert.org.tw
CWE-565
2025-03-17
CVE-2025-2395

CVSS Score

9.8 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Date

  • Published: March 17, 2025, 6:15 a.m.
  • Last Modified: March 17, 2025, 6:15 a.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

twcert@cert.org.tw

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.