CVE-2025-29993

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-29993", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-03-13T06:16:50.277Z", "datePublished": "2025-03-27T09:06:53.028Z", "dateUpdated": "2025-03-27T13:30:08.643Z"}, "containers": {"cna": {"affected": [{"vendor": "Alfasado Inc.", "product": "PowerCMS 6.x series", "versions": [{"version": "6.6 and earlier", "status": "affected"}]}, {"vendor": "Alfasado Inc.", "product": "PowerCMS 5.x series", "versions": [{"version": "5.27 and earlier", "status": "affected"}]}, {"vendor": "Alfasado Inc.", "product": "PowerCMS 4.x series", "versions": [{"version": "4.58 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail."}], "problemTypes": [{"descriptions": [{"description": "Improper neutralization of special elements in output used by a downstream component ('Injection')", "lang": "en-US", "cweId": "CWE-74", "type": "CWE"}]}], "references": [{"url": "https://www.powercms.jp/news/release-powercms-661-528-459.html"}, {"url": "https://jvn.jp/en/jp/JVN39026557/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-03-27T09:06:53.028Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-27T13:30:01.130372Z", "id": "CVE-2025-29993", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T13:30:08.643Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-29993", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-27T13:30:01.130372Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T13:30:05.307Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Alfasado Inc.", "product": "PowerCMS 6.x series", "versions": [{"status": "affected", "version": "6.6 and earlier"}]}, {"vendor": "Alfasado Inc.", "product": "PowerCMS 5.x series", "versions": [{"status": "affected", "version": "5.27 and earlier"}]}, {"vendor": "Alfasado Inc.", "product": "PowerCMS 4.x series", "versions": [{"status": "affected", "version": "4.58 and earlier"}]}], "references": [{"url": "https://www.powercms.jp/news/release-powercms-661-528-459.html"}, {"url": "https://jvn.jp/en/jp/JVN39026557/"}], "descriptions": [{"lang": "en", "value": "The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-74", "description": "Improper neutralization of special elements in output used by a downstream component ('Injection')"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-03-27T09:06:53.028Z"}}}, "cveMetadata": {"cveId": "CVE-2025-29993", "state": "PUBLISHED", "dateUpdated": "2025-03-27T13:30:08.643Z", "dateReserved": "2025-03-13T06:16:50.277Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2025-03-27T09:06:53.028Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "PowerCMS 6.x series", "vendor": "Alfasado Inc.", "versions": [{"status": "affected", "version": "6.6 and earlier"}]}, {"product": "PowerCMS 5.x series", "vendor": "Alfasado Inc.", "versions": [{"status": "affected", "version": "5.27 and earlier"}]}, {"product": "PowerCMS 4.x series", "vendor": "Alfasado Inc.", "versions": [{"status": "affected", "version": "4.58 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail."}, {"lang": "es", "value": "Las versiones afectadas de PowerCMS permiten la inyecci\u00f3n de encabezados HTTP. Esta vulnerabilidad puede aprovecharse para que el producto afectado env\u00ede correos electr\u00f3nicos con una URL alterada, como un correo de restablecimiento de contrase\u00f1a."}], "id": "CVE-2025-29993", "lastModified": "2026-06-17T09:06:02.673", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-29993", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-27T13:30:01.130372Z", "version": "2.0.3"}}]}, "published": "2025-03-27T10:15:14.063", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN39026557/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.powercms.jp/news/release-powercms-661-528-459.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{}