CVE-2025-28089
Published: 28 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-28089 is a Server-Side Request Forgery (SSRF) vulnerability, mapped to CWE-918, affecting maccms10 version v2025.1000.4047 in its Scheduled Task function. Published on 2025-03-28, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), highlighting its critical severity due to high impacts on confidentiality and integrity.
Unauthenticated attackers with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation via the Scheduled Task function enables remote adversaries to forge requests from the server, potentially leading to unauthorized access to internal resources, data exfiltration, or manipulation consistent with the high confidentiality and integrity impacts.
Advisories and patch details are referenced in the maccms10 release at https://github.com/magicblack/maccms10/releases/tag/v2025.1000.4047 and further documentation at https://www.yuque.com/morysummer/vx41bz/wzer7qxh0vwrf6zq. Security practitioners should review these sources for mitigation steps, such as applying updates to address the SSRF issue.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SSRF in public-facing Scheduled Task function directly enables T1190 for unauthenticated remote initial access, internal resource access, and data exfiltration.