CVE-2025-14602 : Detail

CVE-2025-14602

2026-08-20
07h16 +00:00
A02-Cryptographic FailuresA01-Broken Access Control
2026-10-06
22h10 +00:00
CVE.org
NVD
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Kelola notifikasi

Deskripsi CVE

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Informasi CVE

Kelemahan Terkait

CWE-ID Nama Kelemahan Sumber
CWE-340 Generation of Predictable Numbers or Identifiers
The product uses a scheme that generates numbers or identifiers that are more predictable than required.
CWE-377 DEPRECATED: Insecure Temporary File
This entry has been deprecated. It was focused only on the affected resource (temporary file) and not the behavior or mistake that produced the insecure temporary file, which caused confusion and incorrect mappings.

Referensi

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.