CVE-2025-62797

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-62797", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-22T18:55:48.011Z", "datePublished": "2025-10-29T17:49:07.899Z", "dateUpdated": "2025-10-29T19:01:54.985Z"}, "containers": {"cna": {"title": "CSRF in FluxCP account endpoints allows account takeover / state-changing actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr"}, {"name": "https://github.com/rathena/FluxCP/commit/e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6", "tags": ["x_refsource_MISC"], "url": "https://github.com/rathena/FluxCP/commit/e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6"}], "affected": [{"vendor": "rathena", "product": "FluxCP", "versions": [{"version": "< e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-29T17:49:07.899Z"}, "descriptions": [{"lang": "en", "value": "FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c."}], "source": {"advisory": "GHSA-5w2g-8cqq-r4fr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-29T19:01:49.685657Z", "id": "CVE-2025-62797", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-29T19:01:54.985Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62797", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-29T19:01:49.685657Z"}}}], "references": [{"url": "https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-29T19:01:41.929Z"}}], "cna": {"title": "CSRF in FluxCP account endpoints allows account takeover / state-changing actions", "source": {"advisory": "GHSA-5w2g-8cqq-r4fr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rathena", "product": "FluxCP", "versions": [{"status": "affected", "version": "< e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6"}]}], "references": [{"url": "https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr", "name": "https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rathena/FluxCP/commit/e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6", "name": "https://github.com/rathena/FluxCP/commit/e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-29T17:49:07.899Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62797", "state": "PUBLISHED", "dateUpdated": "2025-10-29T19:01:54.985Z", "dateReserved": "2025-10-22T18:55:48.011Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-29T17:49:07.899Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FluxCP", "vendor": "rathena", "versions": [{"status": "affected", "version": "< e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c."}, {"lang": "es", "value": "FluxCP es un Panel de Control basado en web para servidores rAthena escrito en PHP. Una vulnerabilidad cr\u00edtica de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) existe en la plantilla de sitio web basada en FluxCP utilizada por m\u00faltiples servidores rAthena/Ragnarok. Los puntos finales POST que cambian de estado aceptan peticiones iniciadas por el navegador que son autorizadas \u00fanicamente por la cookie de sesi\u00f3n sin tokens anti-CSRF por petici\u00f3n o una validaci\u00f3n robusta de Origin/Referer. Un atacante que puede atraer a un usuario autenticado a una p\u00e1gina controlada por el atacante puede hacer que ese usuario realice acciones sensibles sin su intenci\u00f3n. Esta vulnerabilidad se corrige con el commit e3f130c."}], "id": "CVE-2025-62797", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62797", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-29T19:01:49.685657Z", "version": "2.0.3"}}]}, "published": "2025-10-29T18:15:42.437", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rathena/FluxCP/commit/e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6"}, {"source": "security-advisories@github.com", "url": "https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-30T14:37:36.695532+00:00", "updated": "2025-10-30T14:37:36.695587+00:00", "vendors": ["rathena", "rathena$PRODUCT$fluxcp"]}