CVE-2025-3177

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-3177
A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:H/Au:S/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/chujianxin0101/vuln/issues/2 Exploit Third Party Advisory Issue Tracking
https://vuldb.com/?ctiid.303136 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.303136 Third Party Advisory VDB Entry
https://vuldb.com/?submit.543673 Third Party Advisory VDB Entry
https://github.com/chujianxin0101/vuln/issues/2 Exploit Third Party Advisory Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:fastcms_project:fastcms:0.1.5:*:*:*:*:*:*:*
History

08 Apr 2025, 19:40

Type Values Removed Values Added
CWE NVD-CWE-Other
References () https://github.com/chujianxin0101/vuln/issues/2 - () https://github.com/chujianxin0101/vuln/issues/2 - Exploit, Third Party Advisory, Issue Tracking
References () https://vuldb.com/?ctiid.303136 - () https://vuldb.com/?ctiid.303136 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.303136 - () https://vuldb.com/?id.303136 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.543673 - () https://vuldb.com/?submit.543673 - Third Party Advisory, VDB Entry
First Time Fastcms Project
Fastcms Project fastcms
CPE cpe:2.3:a:fastcms_project:fastcms:0.1.5:*:*:*:*:*:*:*

07 Apr 2025, 14:18

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en FastCMS 0.1.5. Se ha declarado crítica. Esta vulnerabilidad afecta al código desconocido del componente JWT Handler. La manipulación implica el uso de una clave criptográfica predefinida. El ataque puede iniciarse remotamente. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado.

03 Apr 2025, 21:15

Type Values Removed Values Added
References () https://github.com/chujianxin0101/vuln/issues/2 - () https://github.com/chujianxin0101/vuln/issues/2 -

03 Apr 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-03 20:15

Updated : 2025-04-08 19:40

NVD link : CVE-2025-3177

Mitre link : CVE-2025-3177

CVE.ORG link : CVE-2025-3177

JSON object : View

Products Affected

fastcms_project

  • fastcms
CWE
CWE-320

Key Management Errors

CWE-321

Use of Hard-coded Cryptographic Key

NVD-CWE-Other