CVE-2025-55370

Published: Aug 21, 2025Modified: Sep 9, 2025

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.

Affected (1)

Products: Jishenghua: Jsherp

Jishenghua

1 product

Jsherp

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jishenghua Jsherp	Version 3.5

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

http://jsherp.com

Source: cve@mitre.org

Broken Link

https://github.com/cina666/CVE/blob/main/jshERP/%E8%B6%8A%E6%9D%83%E8%8E%B7%E5%8F%96%E4%BB%BB%E6%84%8F%E8%B4%A6%E5%8F%B7%E4%BF%A1%E6%81%AF%E5%AE%9E%E7%8E%B0%E4%BB%BB%E6%84%8F%E7%99%BB%E5%BD%95.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/jishenghua/jshERP

Source: cve@mitre.org

Third Party Advisory

Timeline

No history available yet.