Executive Summary

CVE-2025-34467 is a denial-of-service vulnerability in ZwiiCMS versions prior to 13.7.00. It occurs because the application improperly checks authorization and mismanages resource state on multiple administrative endpoints. When a low-privilege authenticated user requests an administrative page, the system returns a "404 Not Found" as expected but mistakenly acquires and associates a temporary lock on the targeted resource with the attacker's session before verifying authorization. This lock prevents other users, including administrators, from accessing that administrative functionality until the attacker leaves the page or the session ends. [3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a denial-of-service condition on administrative pages of ZwiiCMS. An authenticated low-privilege user can lock administrative resources improperly, blocking access for other users and administrators. This can disrupt management and maintenance activities on the website, potentially delaying critical administrative tasks and reducing availability of administrative functions. [3]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ZwiiCMS to version 13.7.00 or later, where the issue has been fixed. Until then, restrict authenticated low-privilege user access to administrative endpoints to prevent exploitation. Additionally, monitor sessions for unusual locking behavior and consider terminating suspicious sessions to restore access to locked administrative resources. [3]

Useful 0 Not Useful 0