CVE-2025-32352: Medium severity zendto vulnerability
Published Apr 5, 2025
·Updated
A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. A solution requires moving from MD5 to bcrypt.
Affected Software
1 affected component
ZendTo ZendTo<5.04-7
Event History
Apr 5, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeakness
Apr 5, 57247
Event
via FIRST·11:21 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-32352?
CVE-2025-32352 is considered a high-severity vulnerability due to its potential for unauthorized access.
2
How do I fix CVE-2025-32352?
To fix CVE-2025-32352, transition from using MD5 hashes to bcrypt for storing user passwords.
3
Which software versions are affected by CVE-2025-32352?
CVE-2025-32352 affects ZendTo versions before 5.04-7.
4
What type of vulnerability is CVE-2025-32352?
CVE-2025-32352 is classified as a type confusion vulnerability.
5
Can CVE-2025-32352 be exploited remotely?
Yes, CVE-2025-32352 can be exploited remotely to bypass authentication mechanisms.