CVE-2025-43955CWE-74CWE-749

CVE-2025-43955

Low · published April 21, 2025

CVSS v3.1
2.2
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.5th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-749 · Exposed Dangerous Method or Function
Published
2025-04-21T00:15Z
Affected products (1)
ProductVersionsFixed in
convertigo/convertigo< 8.3.118.3.11
References (4)
https://github.com/convertigo/convertigo/blob/8.3.11/CHANGELOG.md#8311 · [email protected]https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1 · [email protected]https://github.com/convertigo/convertigo/issues/898 · [email protected]https://github.com/convertigo/convertigo/releases/tag/8.3.11 · [email protected]
EPSS history
Timeline
  • 20 APR 00:00Z
    TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs
    cvelistv5