CVE-2025-64781

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64781", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-11-27T05:42:04.952Z", "datePublished": "2025-12-12T05:02:58.824Z", "dateUpdated": "2025-12-12T20:26:03.855Z"}, "containers": {"cna": {"affected": [{"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession Free edition", "versions": [{"version": "prior to ver5.7.1", "status": "affected"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession byCloud", "versions": [{"version": "prior to ver5.7.1", "status": "affected"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession ZION", "versions": [{"version": "prior to ver5.7.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, \"External page display restriction\" is set to \"Do not limit\" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website when accessing a specially crafted URL."}], "problemTypes": [{"descriptions": [{"description": "Initialization of a resource with an insecure default", "lang": "en-US", "cweId": "CWE-1188", "type": "CWE"}]}], "references": [{"url": "https://groupsession.jp/info/info-news/security20251208"}, {"url": "https://jvn.jp/en/jp/JVN19940619/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-12-12T05:02:58.824Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T20:25:44.579958Z", "id": "CVE-2025-64781", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T20:26:03.855Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64781", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T20:25:44.579958Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T20:25:53.517Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession Free edition", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession byCloud", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession ZION", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}], "references": [{"url": "https://groupsession.jp/info/info-news/security20251208"}, {"url": "https://jvn.jp/en/jp/JVN19940619/"}], "descriptions": [{"lang": "en", "value": "In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, \"External page display restriction\" is set to \"Do not limit\" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website when accessing a specially crafted URL."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-1188", "description": "Initialization of a resource with an insecure default"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-12-12T05:02:58.824Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64781", "state": "PUBLISHED", "dateUpdated": "2025-12-12T20:26:03.855Z", "dateReserved": "2025-11-27T05:42:04.952Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2025-12-12T05:02:58.824Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "GroupSession Free edition", "vendor": "Japan Total System Co.,Ltd.", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}, {"product": "GroupSession byCloud", "vendor": "Japan Total System Co.,Ltd.", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}, {"product": "GroupSession ZION", "vendor": "Japan Total System Co.,Ltd.", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}], "source": "vultures@jpcert.or.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:bycloud:*:*:*", "matchCriteriaId": "0023BDD1-63A1-4F4B-A949-7B5687512F86", "versionEndExcluding": "5.7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:free:*:*:*", "matchCriteriaId": "41253C33-6699-4FE8-80B5-917FF6F71E65", "versionEndExcluding": "5.7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:zion:*:*:*", "matchCriteriaId": "428C47F8-9B26-4902-80C5-2E6A9D09B28E", "versionEndExcluding": "5.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, \"External page display restriction\" is set to \"Do not limit\" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website when accessing a specially crafted URL."}, {"lang": "es", "value": "En GroupSession Free edition anterior a la ver5.7.1, GroupSession byCloud anterior a la ver5.7.1, y GroupSession ZION anterior a la ver5.7.1, 'Restricci\u00f3n de visualizaci\u00f3n de p\u00e1gina externa' est\u00e1 configurado como 'No limitar' en la configuraci\u00f3n inicial. Con esta configuraci\u00f3n, el usuario puede ser redirigido a un sitio web arbitrario al acceder a una URL especialmente dise\u00f1ada."}], "id": "CVE-2025-64781", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64781", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-12T20:25:44.579958Z", "version": "2.0.3"}}]}, "published": "2025-12-12T05:16:11.623", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://groupsession.jp/info/info-news/security20251208"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN19940619/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"created": "2025-12-12T08:47:46.893925+00:00", "updated": "2025-12-12T08:47:46.894033+00:00", "vendors": ["groupsession", "groupsession$PRODUCT$groupsession", "groupsession$PRODUCT$groupsession_bycloud", "groupsession$PRODUCT$groupsession_zion"]}