CVE-2025-61582

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61582", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-26T16:25:25.149Z", "datePublished": "2025-10-01T22:20:35.501Z", "dateUpdated": "2025-10-03T14:24:28.102Z"}, "containers": {"cna": {"title": "Ts3 Manager: Unauthenticated Denial of Service possible through specially crafted Unicode input", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-4cq4-hp4f-8w7p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-4cq4-hp4f-8w7p"}, {"name": "https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e", "tags": ["x_refsource_MISC"], "url": "https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e"}], "affected": [{"vendor": "joni1802", "product": "ts3-manager", "versions": [{"version": "< 2.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-01T22:20:35.501Z"}, "descriptions": [{"lang": "en", "value": "TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2."}], "source": {"advisory": "GHSA-4cq4-hp4f-8w7p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T14:23:58.829403Z", "id": "CVE-2025-61582", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T14:24:28.102Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61582", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T14:23:58.829403Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T14:24:18.566Z"}}], "cna": {"title": "Ts3 Manager: Unauthenticated Denial of Service possible through specially crafted Unicode input", "source": {"advisory": "GHSA-4cq4-hp4f-8w7p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "joni1802", "product": "ts3-manager", "versions": [{"status": "affected", "version": "< 2.2.2"}]}], "references": [{"url": "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-4cq4-hp4f-8w7p", "name": "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-4cq4-hp4f-8w7p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e", "name": "https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-01T22:20:35.501Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61582", "state": "PUBLISHED", "dateUpdated": "2025-10-03T14:24:28.102Z", "dateReserved": "2025-09-26T16:25:25.149Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-01T22:20:35.501Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "ts3-manager", "vendor": "joni1802", "versions": [{"status": "affected", "version": "< 2.2.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joni1802:ts3_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "90BBB279-A3AC-422B-B626-3A1E55344374", "versionEndExcluding": "2.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2."}, {"lang": "es", "value": "TS3 Manager es una interfaz web moderna para mantener servidores Teamspeak3. Se ha identificado una vulnerabilidad de Denegaci\u00f3n de Servicio en las versiones 2.2.1 y anteriores. La vulnerabilidad permite a un actor no autenticado bloquear la aplicaci\u00f3n mediante el env\u00edo de una entrada Unicode especialmente dise\u00f1ada, sin requerir autenticaci\u00f3n o privilegios previos. El fallo se manifiesta cuando se env\u00edan caracteres de etiqueta Unicode al campo Servidor en la p\u00e1gina de inicio de sesi\u00f3n. La aplicaci\u00f3n no maneja correctamente estos caracteres durante el proceso de conversi\u00f3n ASCII, lo que resulta en una excepci\u00f3n no controlada que termina la aplicaci\u00f3n en un plazo de cuatro a cinco segundos desde el env\u00edo. Este problema est\u00e1 solucionado en la versi\u00f3n 2.2.2."}], "id": "CVE-2025-61582", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61582", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T14:23:58.829403Z", "version": "2.0.3"}}]}, "published": "2025-10-01T23:15:30.340", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/joni1802/ts3-manager/security/advisories/GHSA-4cq4-hp4f-8w7p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-02T08:38:20.975463+00:00", "updated": "2025-10-02T08:38:20.975510+00:00", "vendors": ["teamspeak3_manager_project", "teamspeak3_manager_project$PRODUCT$ts3_manager"]}