CVE-2025-8814

atjiu pybbs CookieUtil.java setCookie cross-site request forgery

State: Published
Severity: 5.3 Medium
Published: Aug 10, 2025
Updated: Aug 12, 2025
Reserved: Aug 9, 2025

Description

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-352 Cross-Site Request Forgery
CWE-862 Missing Authorization

Affected Products

Product	Versions
pybbsatjiu	6.0Affected

References

VDB-319343 | atjiu pybbs CookieUtil.java setCookie cross-site request forgeryvdb-entrytechnical-description
VDB-319343 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #622334 | atjiu https://github.com/atjiu/pybbs <=6.0.0 CSRFthird-party-advisory
Submit #622353 | atjiu https://github.com/atjiu/pybbs <=6.0.0 CSRF (Duplicate)third-party-advisory
https://github.com/atjiu/pybbs/issues/211issue-tracking
https://github.com/atjiu/pybbs/issues/211#issuecomment-3134960777issue-tracking
https://github.com/atjiu/pybbs/issues/211#issue-3256483043exploitissue-tracking
https://github.com/atjiu/pybbs/commit/8aa2bb1aef3346e49aec6358edf5e47ce905ae7bpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.