CVE-2025-71455

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71455", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T20:21:24.134Z", "datePublished": "2026-11-04T20:36:43.841Z", "dateUpdated": "2026-11-05T19:24:04.539Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:43.841Z"}, "datePublic": "2025-08-12T00:00:00.000Z", "title": "vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service", "descriptions": [{"lang": "en", "value": "vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "affected": [{"vendor": "vtenext", "product": "vtenext", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "25.02.2", "status": "affected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vtenext:vtenext:*:*:*:*:*:*:*:*", "versionEndExcluding": "25.02.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/", "tags": ["third-party-advisory", "exploit"]}, {"url": "https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/", "tags": ["technical-description"]}, {"url": "https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note", "tags": ["release-notes"]}, {"name": "VulnCheck Advisory: vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service"}], "credits": [{"lang": "en", "value": "Mattia \"0xbro\" Brollo", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:23:26.787003Z", "id": "CVE-2025-71455", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:24:04.539Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71455", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:23:26.787003Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:23:31.471Z"}}], "cna": {"title": "vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service", "credits": [{"lang": "en", "type": "finder", "value": "Mattia \"0xbro\" Brollo"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "vtenext", "product": "vtenext", "versions": [{"status": "affected", "version": "0", "lessThan": "25.02.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-08-12T00:00:00.000Z", "references": [{"url": "https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/", "tags": ["third-party-advisory", "exploit"]}, {"url": "https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/", "tags": ["technical-description"]}, {"url": "https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service", "name": "VulnCheck Advisory: vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Exposure of Sensitive Information to an Unauthorized Actor"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vtenext:vtenext:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "25.02.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:43.841Z"}}}, "cveMetadata": {"cveId": "CVE-2025-71455", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:24:04.539Z", "dateReserved": "2026-11-04T20:21:24.134Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-04T20:36:43.841Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "vtenext", "vendor": "vtenext", "versions": [{"lessThan": "25.02.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions."}, {"lang": "es", "value": "vtenext anterior a la versi\u00f3n 25.02.2 contiene una vulnerabilidad de divulgaci\u00f3n de identificador de sesi\u00f3n que permite a los atacantes leer el valor PHPSESSID devuelto por el endpoint del servicio web Touch. Los atacantes que pueden ejecutar scripts en el origen de vtenext, como a trav\u00e9s de Cross-site Scripting (XSS), pueden eludir la bandera HttpOnly y secuestrar sesiones autenticadas."}], "id": "CVE-2025-71455", "lastModified": "2026-11-12T21:36:06.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71455", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:23:26.787003Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:17:40.017", "references": [{"source": "disclosure@vulncheck.com", "url": "https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"}, {"source": "disclosure@vulncheck.com", "url": "https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"}, {"source": "disclosure@vulncheck.com", "url": "https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.02.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vtenext", "source": "cna", "vendor": "vtenext"}, "product": "vtenext", "vendor": "vtenext"}], "created": "2026-11-04T21:45:14.734091+00:00", "updated": "2026-11-04T22:30:13.767067+00:00", "vendors": ["vtenext", "vtenext$PRODUCT$vtenext"]}