CVE-2025-57644
BaseFortify
Publication date: 2025-09-19
Last updated on: 2025-10-17
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| accela | automation_platform | 22.2.3.0.230103 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Accela Automation Platform 22.2.3.0.230103 within its Test Script feature. It allows an authenticated administrative user to execute arbitrary Java code on the server, leading to remote code execution. Additionally, due to improper input validation, it permits arbitrary file writes and server-side request forgery (SSRF), which can be used to interact with internal or external systems.
How can this vulnerability impact me? :
Exploitation of this vulnerability can result in full server compromise, unauthorized access to sensitive data, and further exploitation within the network. This means attackers could take control of the server, steal or manipulate data, and potentially move laterally to other systems.