CVE-2025-2420

猫宁i Morning cross-site request forgery

State: Published
Severity: 5.3 Medium
Published: Mar 17, 2025
Updated: Mar 18, 2025
Reserved: Mar 17, 2025

Description

A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N	VulDB

Weaknesses

CWE-352 Cross-Site Request Forgery
CWE-862 Missing Authorization

Affected Products

Product	Versions
Morning猫宁i	bc782730c74ff080494f145cc363a0b4f43f7d3eAffected

References

VDB-299917 | 猫宁i Morning cross-site request forgeryvdb-entry
VDB-299917 | CTI Indicators (IOB, IOC)signaturepermissions-required
Submit #517009 | 猫宁i Morning null Cross-Site Request Forgerythird-party-advisory
https://gitee.com/morning-pro/Morning/issues/IBRVMXexploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.