CVE-2025-1108: Insufficient data authenticity vulnerability in Janto
First published: Fri Feb 07 2025(Updated: )
Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into the ‘Xml’ parameter on the ‘/public/cgi/Gateway.php’ endpoint.
Credit: cve-coordination@incibe.es
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Janto | <r12 |
Remedy
With the implemented patches by the Impronta team, the detected vulnerabilities have been fixed. All customers using this product in SaaS mode have been upgraded to version r12 which fixes these issues.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-1108?
CVE-2025-1108 is classified as a medium severity vulnerability due to its ability to allow unauthorized content modification in password reset emails.
How do I fix CVE-2025-1108?
To fix CVE-2025-1108, upgrade Janto to version r12 or later where this vulnerability is addressed.
Who is affected by CVE-2025-1108?
CVE-2025-1108 affects all versions of Janto prior to r12, allowing attackers to exploit email content.
What type of attack does CVE-2025-1108 enable?
CVE-2025-1108 enables unauthorized attackers to modify content in password reset emails through insufficient data authenticity verification.
Can CVE-2025-1108 be exploited without authentication?
Yes, CVE-2025-1108 can be exploited by unauthenticated attackers, making it particularly concerning.
- agent/weakness
- agent/remedy
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- collector/nvd-api
- source/NVD
- agent/severity
- agent/source
- agent/author
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/janto
- canonical/janto