CVE-2025-64781CWE-1188

CVE-2025-64781

Medium · published December 12, 2025

CVSS v3.0
4.7
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website when accessing a specially crafted URL.

The record
Technical detail
CVSS v3.0
4.7 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.3th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2025-12-12T10:16Z
Affected products (3)
ProductVersionsFixed in
groupsession/groupsession< 5.7.15.7.1
groupsession/groupsession< 5.7.15.7.1
groupsession/groupsession< 5.7.15.7.1
References (2)
https://groupsession.jp/info/info-news/security20251208 · [email protected]https://jvn.jp/en/jp/JVN19940619/ · [email protected]
EPSS history
Timeline
  • 12 DEC 05:02Z
    In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display…
    cvelistv5