fkie_cve-2025-32951
Vulnerability from fkie_nvd
Published
2025-04-22 18:15
Modified
2025-12-31 15:57
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website.
References
security-advisories@github.comhttps://docs.jmix.io/jmix/files-vulnerabilities.htmlVendor Advisory
security-advisories@github.comhttps://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-applicationVendor Advisory
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2Patch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6aPatch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37Patch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aaPatch
security-advisories@github.comhttps://github.com/jmix-framework/jmix/issues/3804Issue Tracking
security-advisories@github.comhttps://github.com/jmix-framework/jmix/issues/3836Issue Tracking
security-advisories@github.comhttps://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93Patch, Vendor Advisory
Impacted products
Vendor Product Version
haulmont cuba_platform *
haulmont cuba_rest_api *
haulmont jmix_framework *
haulmont jmix_framework *
haulmont jpa_web_api *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haulmont:cuba_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4144D951-290E-4CDD-88B0-F4052FD28B7F",
              "versionEndExcluding": "7.2.23",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:cuba_rest_api:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9943C493-5789-4D32-A280-7BA564818C8A",
              "versionEndExcluding": "7.2.7",
              "versionStartIncluding": "7.1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A877F67E-4952-4984-8F29-A5DFD0E3090A",
              "versionEndExcluding": "1.6.2",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jmix_framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "266AE114-6141-48C3-BCBC-33C47FBE0B89",
              "versionEndExcluding": "2.4.0",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:haulmont:jpa_web_api:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FCA5975A-4E12-4D55-A93B-486BC1D9F219",
              "versionEndExcluding": "1.1.1",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in versions 1.6.2 and 2.4.0. A workaround is provided on the Jmix documentation website."
    },
    {
      "lang": "es",
      "value": "Jmix es un conjunto de librer\u00edas y herramientas para acelerar el desarrollo de aplicaciones centradas en datos en Spring Boot. En las versiones 1.0.0 a 1.6.1 y 2.0.0 a 2.3.4, el par\u00e1metro de entrada, que consiste en la ruta y el nombre del archivo, se puede manipular para devolver el encabezado Content-Type con text/html si el nombre termina en .html. Esto podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo JavaScript malicioso en el navegador. Para que un ataque tenga \u00e9xito, es necesario cargar previamente un archivo malicioso. Este problema se ha corregido en las versiones 1.6.2 y 2.4.0. Se ofrece un workaround en el sitio web de documentaci\u00f3n de Jmix."
    }
  ],
  "id": "CVE-2025-32951",
  "lastModified": "2025-12-31T15:57:34.573",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-22T18:15:59.940",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-jmix-application"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/6a66aa3adb967159a30d703e80403406f4c8f7a2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/c589ef4e2b25620770b8036f4ad05f1a6250cb6a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/cc97e6ff974b9e7af8160fab39cc5866169daa37"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jmix-framework/jmix/commit/f4e6fb05bd245cf36f3e9319aaa0fcd540d024aa"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jmix-framework/jmix/issues/3804"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/jmix-framework/jmix/issues/3836"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.