CVE-2025-4542
Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policy
- State
- Published
- Severity
- 2.3 Low
- Published
- May 11, 2025
- Updated
- May 12, 2025
- Reserved
- May 10, 2025
Description
A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functionality of the file /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N | VulDB |
| 3.0 | 3.1 Low | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N | VulDB |
| 2.0 | 2.6 Low | AV:N/AC:H/Au:N/C:N/I:P/A:N | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Hotel 酒店管理系统 APIFreeebird |
|
References
- VDB-308288 | Freeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policyvdb-entry
- VDB-308288 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #567214 | freeebird hotel 1.2 branch Permissive Cross-domain Policy with Untrusted Domainsthird-party-advisory
- https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250429-01.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.