CVE-2025-11336
BaseFortify
Publication date: 2025-10-06
Last updated on: 2025-10-06
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| four-faith | water_conservancy_informatization_platform | 2.2 |
| four-faith | water_conservancy_informatization_platform | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11336 is a path traversal vulnerability in the Four-Faith Water Conservancy Informatization Platform up to version 2.2. It exists in the handling of the 'fileName' parameter in the '/stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do' endpoint. Due to improper input validation and sanitization, an attacker can manipulate this parameter to access arbitrary files on the server remotely without authentication. This allows unauthorized reading of sensitive files, such as configuration files, potentially exposing confidential information. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows unauthenticated remote attackers to read arbitrary files on the affected server. This can lead to exposure of sensitive information, such as configuration files, which may contain credentials or other critical data. The unauthorized disclosure of such information can compromise system confidentiality and potentially facilitate further attacks or unauthorized access. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted HTTP GET requests to the vulnerable endpoint to check for path traversal. For example, you can use curl to test if the server returns sensitive files by manipulating the fileName parameter. A sample command is: curl -v "http://[target]/stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do?fileName=../WEB-INF/classes/web.properties". If the server responds with the contents of the file, the vulnerability exists. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict input validation on the fileName parameter to prevent path traversal, enforcing file access controls to restrict unauthorized file reads, applying any available patches if released, conducting security audits, and considering replacing the affected product since no known patches currently exist. [2, 3]