CVE-2025-43955

תיאור (מקור, אנגלית)

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

מדדים

CVSS 3.1

6.8 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-20/9/2026

CWE

CWE-749, CWE-74

מוצרים מושפעים

convertigo: convertigo

קישורים

• https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287‮… Patch
• https://github.com/convertigo/convertigo/issues/898 ExploitIssue Tracking
• https://github.com/convertigo/convertigo/blob/8.3.11/CHANGELOG.md#8311 Release Notes
• https://github.com/convertigo/convertigo/releases/tag/8.3.11 Release Notes