Getrebuild

getrebuild

4 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-50900 1Getrebuild 1Rebuild Oct 9, 2025 Aug 25, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affected function is preHandle In the filter code, use CodecUtils.urlDecode(request.ge...Show more An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affected function is preHandle In the filter code, use CodecUtils.urlDecode(request.getRequestURI()) to obtain the URL-decoded request path, and then determine whether the path endsWith /error. If so, execute return true to skip this Interceptor. Else, redirect to /user/login api. Allowing unauthenticated attackers to gain sensitive information or escalated privileges.Show less
CVE-2024-46413 1Getrebuild 1Rebuild Sep 12, 2025 Aug 25, 2025 N/A· v4 5.1 MEDIUM· v3 N/A· v2 Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loadDataIndex method.
CVE-2024-25294 1Getrebuild 1Rebuild Jun 17, 2025 Mar 20, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,URL parameters.
CVE-2023-2474 1Getrebuild 1Rebuild Nov 21, 2024 May 2, 2023 N/A· v4 4.3 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploi...Show more A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-227866 is the identifier assigned to this vulnerability.Show less