CVE-2025-62192

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-62192", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-11-27T05:42:06.772Z", "datePublished": "2025-12-12T05:02:38.764Z", "dateUpdated": "2025-12-12T20:36:24.896Z"}, "containers": {"cna": {"affected": [{"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession Free edition", "versions": [{"version": "prior to ver5.3.0", "status": "affected"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession byCloud", "versions": [{"version": "prior to ver5.3.3", "status": "affected"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession ZION", "versions": [{"version": "prior to ver5.3.2", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If exploited, information stored in the database may be obtained or altered by an authenticated user."}], "problemTypes": [{"descriptions": [{"description": "Improper neutralization of special elements used in an SQL command ('SQL Injection')", "lang": "en-US", "cweId": "CWE-89", "type": "CWE"}]}], "references": [{"url": "https://groupsession.jp/info/info-news/security20251208"}, {"url": "https://jvn.jp/en/jp/JVN19940619/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-12-12T05:02:38.764Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T20:36:12.674921Z", "id": "CVE-2025-62192", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T20:36:24.896Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-62192", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-11-27T05:42:06.772Z", "datePublished": "2025-12-12T05:02:38.764Z", "dateUpdated": "2025-12-12T20:36:24.896Z"}, "containers": {"cna": {"affected": [{"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession Free edition", "versions": [{"version": "prior to ver5.3.0", "status": "affected"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession byCloud", "versions": [{"version": "prior to ver5.3.3", "status": "affected"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession ZION", "versions": [{"version": "prior to ver5.3.2", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If exploited, information stored in the database may be obtained or altered by an authenticated user."}], "problemTypes": [{"descriptions": [{"description": "Improper neutralization of special elements used in an SQL command ('SQL Injection')", "lang": "en-US", "cweId": "CWE-89", "type": "CWE"}]}], "references": [{"url": "https://groupsession.jp/info/info-news/security20251208"}, {"url": "https://jvn.jp/en/jp/JVN19940619/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-12-12T05:02:38.764Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-12T20:36:12.674921Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T20:23:52.021Z"}}]}}

{"affected": [{"affectedData": [{"product": "GroupSession Free edition", "vendor": "Japan Total System Co.,Ltd.", "versions": [{"status": "affected", "version": "prior to ver5.3.0"}]}, {"product": "GroupSession byCloud", "vendor": "Japan Total System Co.,Ltd.", "versions": [{"status": "affected", "version": "prior to ver5.3.3"}]}, {"product": "GroupSession ZION", "vendor": "Japan Total System Co.,Ltd.", "versions": [{"status": "affected", "version": "prior to ver5.3.2"}]}], "source": "vultures@jpcert.or.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:free:*:*:*", "matchCriteriaId": "32599C61-0938-49C5-8416-44C3DF7B144A", "versionEndExcluding": "5.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:zion:*:*:*", "matchCriteriaId": "46F7CACE-2448-4A90-9192-B6270B33E393", "versionEndExcluding": "5.3.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:bycloud:*:*:*", "matchCriteriaId": "DD4CD8BC-39CB-44FF-A4D8-22C1B38ED223", "versionEndExcluding": "5.3.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If exploited, information stored in the database may be obtained or altered by an authenticated user."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL existe en GroupSession Free edition anterior a la ver5.3.0, GroupSession byCloud anterior a la ver5.3.3, y GroupSession ZION anterior a la ver5.3.2. Si se explota, la informaci\u00f3n almacenada en la base de datos puede ser obtenida o alterada por un usuario autenticado."}], "id": "CVE-2025-62192", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62192", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T20:36:12.674921Z", "version": "2.0.3"}}]}, "published": "2025-12-12T05:16:10.950", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://groupsession.jp/info/info-news/security20251208"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN19940619/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"created": "2025-12-12T08:47:53.256780+00:00", "updated": "2025-12-12T08:47:53.256806+00:00", "vendors": ["groupsession", "groupsession$PRODUCT$groupsession", "groupsession$PRODUCT$groupsession_bycloud", "groupsession$PRODUCT$groupsession_zion"]}