SB2025071668 - Multiple vulnerabilities in Infrastructure Technology

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025071668

SB2025071668 - Multiple vulnerabilities in Infrastructure Technology

Published: July 16, 2025

Security Bulletin ID SB2025071668
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2024-47561)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when parsing schema in Java SDK. A remote attacker can pass specially crafted schema to the application and execute arbitrary code on the system.


2) Incorrect default permissions (CVE-ID: CVE-2023-49582)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to lax permissions set by the Apache Portable Runtime library on Unix platforms. A local user can read the named shared memory segments.


3) XML External Entity injection (CVE-ID: CVE-2024-28168)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.


Remediation

Install update from vendor's website.

References