CVE-2025-1341

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1341
A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.

3.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://mega.nz/file/yY0BnAgK#08RcRH8c8D4zMhKLEqQwMenHV65lnHsOSuV4eQkdcxY Exploit
https://vuldb.com/?ctiid.295959 Permissions Required VDB Entry
https://vuldb.com/?id.295959 Third Party Advisory VDB Entry
https://vuldb.com/?submit.495635 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:pmweb:pmweb:7.2.00:*:*:*:*:*:*:*
History

16 Oct 2025, 19:48

Type Values Removed Values Added
Summary
  • (es) En PMWeb 7.2.0 se ha detectado una vulnerabilidad clasificada como problemática que afecta a una parte desconocida del componente Setting Handler. La manipulación da lugar a requisitos de contraseña débiles. Es posible iniciar el ataque de forma remota. La complejidad del ataque es bastante alta. Se dice que la explotación es difícil. El exploit se ha hecho público y puede utilizarse. Se recomienda cambiar los ajustes de configuración. Se contactó al proveedor con antelación sobre esta revelación, pero no respondió de ninguna manera.
CPE cpe:2.3:a:pmweb:pmweb:7.2.00:*:*:*:*:*:*:*
References () https://mega.nz/file/yY0BnAgK#08RcRH8c8D4zMhKLEqQwMenHV65lnHsOSuV4eQkdcxY - () https://mega.nz/file/yY0BnAgK#08RcRH8c8D4zMhKLEqQwMenHV65lnHsOSuV4eQkdcxY - Exploit
References () https://vuldb.com/?ctiid.295959 - () https://vuldb.com/?ctiid.295959 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.295959 - () https://vuldb.com/?id.295959 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.495635 - () https://vuldb.com/?submit.495635 - Third Party Advisory, VDB Entry
First Time Pmweb
Pmweb pmweb

16 Feb 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-16 14:15

Updated : 2025-10-16 19:48

NVD link : CVE-2025-1341

Mitre link : CVE-2025-1341

CVE.ORG link : CVE-2025-1341

JSON object : View

Products Affected

pmweb

  • pmweb
CWE
CWE-521

Weak Password Requirements