CVE-2025-15098

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15098", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-12-25T16:08:17.380Z", "datePublished": "2025-12-26T03:02:06.492Z", "dateUpdated": "2026-10-27T07:19:44.102Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-27T07:19:44.102Z"}, "title": "YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "YunaiV", "product": "yudao-cloud", "versions": [{"version": "2025.0", "status": "affected"}, {"version": "2025.1", "status": "affected"}, {"version": "2025.2", "status": "affected"}, {"version": "2025.3", "status": "affected"}, {"version": "2025.4", "status": "affected"}, {"version": "2025.5", "status": "affected"}, {"version": "2025.6", "status": "affected"}, {"version": "2025.7", "status": "affected"}, {"version": "2025.8", "status": "affected"}, {"version": "2025.9", "status": "affected"}, {"version": "2025.10", "status": "affected"}, {"version": "2025.11", "status": "affected"}], "cpes": ["cpe:2.3:a:yunaiv:yudao-cloud:*:*:*:*:*:*:*:*"], "modules": ["Business Process Management"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing a manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. It is recommended to upgrade the affected component. The vendor confirms: \"[W]e retain BPM's configured HTTP integration capability, including legitimate internal-service calls, and the existing RestTemplate client. We have added an optional server-side hostname/IP allow/deny check in Boot and Cloud master-jdk17.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2025-12-25T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-12-25T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-27T08:24:37.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Ana10gy (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/338429", "name": "VDB-338429 | YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/338429/cti", "name": "VDB-338429 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2025-15098", "name": "CVE-2025-15098 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/710170", "name": "Submit #710170 | YunaiV YuDao Cloud <=v2025.11 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md", "tags": ["related"]}, {"url": "https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md#proof-of-concept", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-26T19:29:24.006123Z", "id": "CVE-2025-15098", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-26T19:29:29.970Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15098", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-26T19:29:24.006123Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-26T19:29:27.127Z"}}], "cna": {"title": "YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "Ana10gy (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:yunaiv:yudao-cloud:*:*:*:*:*:*:*:*"], "vendor": "YunaiV", "modules": ["Business Process Management"], "product": "yudao-cloud", "versions": [{"status": "affected", "version": "2025.0"}, {"status": "affected", "version": "2025.1"}, {"status": "affected", "version": "2025.2"}, {"status": "affected", "version": "2025.3"}, {"status": "affected", "version": "2025.4"}, {"status": "affected", "version": "2025.5"}, {"status": "affected", "version": "2025.6"}, {"status": "affected", "version": "2025.7"}, {"status": "affected", "version": "2025.8"}, {"status": "affected", "version": "2025.9"}, {"status": "affected", "version": "2025.10"}, {"status": "affected", "version": "2025.11"}]}], "timeline": [{"lang": "en", "time": "2025-12-25T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-12-25T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-27T08:24:37.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/338429", "name": "VDB-338429 | YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/338429/cti", "name": "VDB-338429 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2025-15098", "name": "CVE-2025-15098 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/710170", "name": "Submit #710170 | YunaiV YuDao Cloud <=v2025.11 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md", "tags": ["related"]}, {"url": "https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md#proof-of-concept", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing a manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. It is recommended to upgrade the affected component. The vendor confirms: \"[W]e retain BPM's configured HTTP integration capability, including legitimate internal-service calls, and the existing RestTemplate client. We have added an optional server-side hostname/IP allow/deny check in Boot and Cloud master-jdk17.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-27T07:19:44.102Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15098", "state": "PUBLISHED", "dateUpdated": "2026-10-27T07:19:44.102Z", "dateReserved": "2025-12-25T16:08:17.380Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-12-26T03:02:06.492Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:yunaiv:yudao-cloud:*:*:*:*:*:*:*:*"], "modules": ["Business Process Management"], "product": "yudao-cloud", "vendor": "YunaiV", "versions": [{"status": "affected", "version": "2025.0"}, {"status": "affected", "version": "2025.1"}, {"status": "affected", "version": "2025.2"}, {"status": "affected", "version": "2025.3"}, {"status": "affected", "version": "2025.4"}, {"status": "affected", "version": "2025.5"}, {"status": "affected", "version": "2025.6"}, {"status": "affected", "version": "2025.7"}, {"status": "affected", "version": "2025.8"}, {"status": "affected", "version": "2025.9"}, {"status": "affected", "version": "2025.10"}, {"status": "affected", "version": "2025.11"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing a manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. It is recommended to upgrade the affected component. The vendor confirms: \"[W]e retain BPM's configured HTTP integration capability, including legitimate internal-service calls, and the existing RestTemplate client. We have added an optional server-side hostname/IP allow/deny check in Boot and Cloud master-jdk17.\""}, {"lang": "es", "value": "Una vulnerabilidad fue determinada en YunaiV yudao-cloud hasta 2025.11. Esto afecta la funci\u00f3n BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger del componente Gesti\u00f3n de Procesos de Negocio. La ejecuci\u00f3n de la manipulaci\u00f3n del argumento url/header/body puede llevar a falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque puede ser realizado de forma remota. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2025-15098", "lastModified": "2026-10-27T08:16:52.143", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15098", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-26T19:29:24.006123Z", "version": "2.0.3"}}]}, "published": "2025-12-26T03:15:50.460", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md#proof-of-concept"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2025-15098"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/710170"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/338429"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/338429/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-12-29T22:33:33.666875+00:00", "updated": "2025-12-29T22:33:33.666903+00:00", "vendors": ["yunaiv", "yunaiv$PRODUCT$yudao-cloud"]}