CVE-2025-2709: Yonyou UFIDA ERP-NC login.jsp cross site scripting

Published Mar 24, 2025

Updated

A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file /login.jsp. The manipulation of the argument key/redirect leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou UFIDA ERP-NC

Yonyou UFIDA ERP-NC=5.0

Event History

Mar 24, 2025

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

May 24, 58462

Event

via NVD·08:16 PM

Frequently Asked Questions

What is the severity of CVE-2025-2709?

CVE-2025-2709 is classified as a problematic vulnerability due to its potential for remote exploitation.

How do I fix CVE-2025-2709?

To mitigate CVE-2025-2709, ensure that your Yonyou UFIDA ERP-NC system is updated to a secure version that addresses this issue.

What impact does CVE-2025-2709 have on the system?

CVE-2025-2709 affects the /login.jsp file and can lead to cross-site scripting via manipulation of the key/redirect parameters.

Can CVE-2025-2709 be exploited remotely?

Yes, CVE-2025-2709 can be exploited remotely, making it a significant security concern.

Which software is affected by CVE-2025-2709?

CVE-2025-2709 affects Yonyou UFIDA ERP-NC version 5.0.