CVE-2025-11322

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-11322", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-10-05T06:41:05.233Z", "datePublished": "2025-10-06T05:32:05.987Z", "dateUpdated": "2025-10-06T17:18:06.064Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-10-06T05:32:05.987Z"}, "title": "Mangati NovoSGA User Creation new weak password", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-521", "lang": "en", "description": "Weak Password Requirements"}]}], "affected": [{"vendor": "Mangati", "product": "NovoSGA", "versions": [{"version": "2.2.0", "status": "affected"}, {"version": "2.2.1", "status": "affected"}, {"version": "2.2.2", "status": "affected"}, {"version": "2.2.3", "status": "affected"}, {"version": "2.2.4", "status": "affected"}, {"version": "2.2.5", "status": "affected"}, {"version": "2.2.6", "status": "affected"}, {"version": "2.2.7", "status": "affected"}, {"version": "2.2.8", "status": "affected"}, {"version": "2.2.9", "status": "affected"}, {"version": "2.2.10", "status": "affected"}, {"version": "2.2.11", "status": "affected"}, {"version": "2.2.12", "status": "affected"}], "modules": ["User Creation Page"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirma\u00e7\u00e3o da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "In Mangati NovoSGA up to 2.2.12 ist eine Schwachstelle entdeckt worden. Betroffen davon ist eine unbekannte Funktion der Datei /novosga.users/new der Komponente User Creation Page. Durch das Beeinflussen des Arguments Senha/Confirma\u00e7\u00e3o da senha mit unbekannten Daten kann eine weak password requirements-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Ein Angriff erfordert eine vergleichsweise hohe Komplexit\u00e4t. Sie ist schwierig auszunutzen. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2025-10-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-10-05T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-10-05T17:29:23.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "marceloQz (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "marceloQz (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/?id.327203", "name": "VDB-327203 | Mangati NovoSGA User Creation new weak password", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.327203", "name": "VDB-327203 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.664517", "name": "Submit #664517 | NovoSGA 2.2.12 Weak Password Requirements", "tags": ["third-party-advisory"]}, {"url": "https://github.com/marcelomulder/CVE/blob/main/NovoSga/CVE-2025-11322.md", "tags": ["related"]}, {"url": "https://github.com/marcelomulder/CVE/blob/main/NovoSga/Weak%20Password%20Policy%20in%20Novosga.md", "tags": ["broken-link", "exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T17:17:41.441391Z", "id": "CVE-2025-11322", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T17:18:06.064Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11322", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T17:17:41.441391Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T17:18:00.879Z"}}], "cna": {"title": "Mangati NovoSGA User Creation new weak password", "credits": [{"lang": "en", "type": "reporter", "value": "marceloQz (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "marceloQz (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Mangati", "modules": ["User Creation Page"], "product": "NovoSGA", "versions": [{"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "2.2.4"}, {"status": "affected", "version": "2.2.5"}, {"status": "affected", "version": "2.2.6"}, {"status": "affected", "version": "2.2.7"}, {"status": "affected", "version": "2.2.8"}, {"status": "affected", "version": "2.2.9"}, {"status": "affected", "version": "2.2.10"}, {"status": "affected", "version": "2.2.11"}, {"status": "affected", "version": "2.2.12"}]}], "timeline": [{"lang": "en", "time": "2025-10-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-10-05T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-10-05T17:29:23.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.327203", "name": "VDB-327203 | Mangati NovoSGA User Creation new weak password", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.327203", "name": "VDB-327203 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.664517", "name": "Submit #664517 | NovoSGA 2.2.12 Weak Password Requirements", "tags": ["third-party-advisory"]}, {"url": "https://github.com/marcelomulder/CVE/blob/main/NovoSga/CVE-2025-11322.md", "tags": ["related"]}, {"url": "https://github.com/marcelomulder/CVE/blob/main/NovoSga/Weak%20Password%20Policy%20in%20Novosga.md", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirma\u00e7\u00e3o da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "In Mangati NovoSGA up to 2.2.12 ist eine Schwachstelle entdeckt worden. Betroffen davon ist eine unbekannte Funktion der Datei /novosga.users/new der Komponente User Creation Page. Durch das Beeinflussen des Arguments Senha/Confirma\u00e7\u00e3o da senha mit unbekannten Daten kann eine weak password requirements-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Ein Angriff erfordert eine vergleichsweise hohe Komplexit\u00e4t. Sie ist schwierig auszunutzen. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-521", "description": "Weak Password Requirements"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-10-06T05:32:05.987Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11322", "state": "PUBLISHED", "dateUpdated": "2025-10-06T17:18:06.064Z", "dateReserved": "2025-10-05T06:41:05.233Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-10-06T05:32:05.987Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["User Creation Page"], "product": "NovoSGA", "vendor": "Mangati", "versions": [{"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "2.2.4"}, {"status": "affected", "version": "2.2.5"}, {"status": "affected", "version": "2.2.6"}, {"status": "affected", "version": "2.2.7"}, {"status": "affected", "version": "2.2.8"}, {"status": "affected", "version": "2.2.9"}, {"status": "affected", "version": "2.2.10"}, {"status": "affected", "version": "2.2.11"}, {"status": "affected", "version": "2.2.12"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirma\u00e7\u00e3o da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una falla en Mangati NovoSGA hasta la versi\u00f3n 2.2.12. El elemento afectado es una funci\u00f3n desconocida del archivo /novosga.users/new del componente P\u00e1gina de Creaci\u00f3n de Usuarios. La manipulaci\u00f3n del argumento Senha/Confirma\u00e7\u00e3o da senha puede llevar a requisitos de contrase\u00f1a d\u00e9biles. El ataque puede lanzarse de forma remota. Los ataques de esta naturaleza son altamente complejos. La explotabilidad se considera dif\u00edcil. El exploit ha sido publicado y puede ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2025-11322", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11322", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T17:17:41.441391Z", "version": "2.0.3"}}]}, "published": "2025-10-06T06:15:35.203", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/marcelomulder/CVE/blob/main/NovoSga/CVE-2025-11322.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/marcelomulder/CVE/blob/main/NovoSga/Weak%20Password%20Policy%20in%20Novosga.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.327203"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.327203"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.664517"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-521"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-10-06T14:39:55.398222+00:00", "updated": "2025-10-06T14:39:55.398279+00:00", "vendors": ["mangati", "mangati$PRODUCT$novosga"]}