CVE-2025-34133

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-34133", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-04-15T19:15:22.562Z", "datePublished": "2025-10-27T15:13:06.704Z", "dateUpdated": "2025-10-27T15:32:02.819Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["API"], "product": "Wimi Teamwork", "vendor": "Cloud Solutions SAS", "versions": [{"lessThan": "7.38.17", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Noa Tchoumak"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field\u2019s value; only the presence of the field is checked. An attacker can craft a cross-site request that causes a logged-in victim\u2019s browser to submit a JSON POST containing an arbitrary or empty 'csrf_token', and the API will execute the request with the victim\u2019s privileges. Successful exploitation can allow an attacker to perform privileged actions as the victim potentially resulting in account takeover, privilege escalation, or service disruption.<br>"}], "value": "Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field\u2019s value; only the presence of the field is checked. An attacker can craft a cross-site request that causes a logged-in victim\u2019s browser to submit a JSON POST containing an arbitrary or empty 'csrf_token', and the API will execute the request with the victim\u2019s privileges. Successful exploitation can allow an attacker to perform privileged actions as the victim potentially resulting in account takeover, privilege escalation, or service disruption."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-10-27T15:13:06.704Z"}, "references": [{"tags": ["product"], "url": "https://www.wimi-teamwork.com/"}, {"tags": ["release-notes", "patch"], "url": "https://www.wimi-teamwork.com/product-news/release-7-38/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wimi-teamwork-csrf"}], "source": {"discovery": "UNKNOWN"}, "title": "Wimi Teamwork < v7.38.17 CSRF", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T15:31:23.487390Z", "id": "CVE-2025-34133", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:32:02.819Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-34133", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:31:23.487390Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:31:35.639Z"}}], "cna": {"title": "Wimi Teamwork < v7.38.17 CSRF", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Noa Tchoumak"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Cloud Solutions SAS", "modules": ["API"], "product": "Wimi Teamwork", "versions": [{"status": "affected", "version": "0", "lessThan": "7.38.17", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.wimi-teamwork.com/", "tags": ["product"]}, {"url": "https://www.wimi-teamwork.com/product-news/release-7-38/", "tags": ["release-notes", "patch"]}, {"url": "https://www.vulncheck.com/advisories/wimi-teamwork-csrf", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field\u2019s value; only the presence of the field is checked. An attacker can craft a cross-site request that causes a logged-in victim\u2019s browser to submit a JSON POST containing an arbitrary or empty 'csrf_token', and the API will execute the request with the victim\u2019s privileges. Successful exploitation can allow an attacker to perform privileged actions as the victim potentially resulting in account takeover, privilege escalation, or service disruption.", "supportingMedia": [{"type": "text/html", "value": "Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field\u2019s value; only the presence of the field is checked. An attacker can craft a cross-site request that causes a logged-in victim\u2019s browser to submit a JSON POST containing an arbitrary or empty 'csrf_token', and the API will execute the request with the victim\u2019s privileges. Successful exploitation can allow an attacker to perform privileged actions as the victim potentially resulting in account takeover, privilege escalation, or service disruption.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-10-27T15:13:06.704Z"}}}, "cveMetadata": {"cveId": "CVE-2025-34133", "state": "PUBLISHED", "dateUpdated": "2025-10-27T15:32:02.819Z", "dateReserved": "2025-04-15T19:15:22.562Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-10-27T15:13:06.704Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["API"], "product": "Wimi Teamwork", "vendor": "Cloud Solutions SAS", "versions": [{"lessThan": "7.38.17", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field\u2019s value; only the presence of the field is checked. An attacker can craft a cross-site request that causes a logged-in victim\u2019s browser to submit a JSON POST containing an arbitrary or empty 'csrf_token', and the API will execute the request with the victim\u2019s privileges. Successful exploitation can allow an attacker to perform privileged actions as the victim potentially resulting in account takeover, privilege escalation, or service disruption."}, {"lang": "es", "value": "Las versiones de Wimi Teamwork anteriores a la 7.38.17 contienen una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en su API. La API acepta cualquier petici\u00f3n autenticada que contiene un campo JSON llamado 'csrf_token' sin validar el valor del campo; solo se verifica la presencia del campo. Un atacante puede crear una petici\u00f3n en sitios cruzados que hace que el navegador de una v\u00edctima que ha iniciado sesi\u00f3n env\u00ede un POST JSON que contiene un 'csrf_token' arbitrario o vac\u00edo, y la API ejecutar\u00e1 la petici\u00f3n con los privilegios de la v\u00edctima. La explotaci\u00f3n exitosa puede permitir a un atacante realizar acciones privilegiadas como la v\u00edctima, lo que podr\u00eda resultar en toma de control de la cuenta, escalada de privilegios o interrupci\u00f3n del servicio."}], "id": "CVE-2025-34133", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34133", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-27T15:31:23.487390Z", "version": "2.0.3"}}]}, "published": "2025-10-27T16:15:39.683", "references": [{"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/wimi-teamwork-csrf"}, {"source": "disclosure@vulncheck.com", "url": "https://www.wimi-teamwork.com/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.wimi-teamwork.com/product-news/release-7-38/"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2025-10-27T22:03:40.691095+00:00", "updated": "2025-10-27T22:03:40.691120+00:00", "vendors": ["wimi_teamwork", "wimi_teamwork$PRODUCT$wimi_teamwork"]}