CVE-2025-3413: opplus springboot-admin SysGeneratorController.java code deserialization
First published: Tue Apr 08 2025(Updated: )
A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerability is the function code of the file SysGeneratorController.java. The manipulation of the argument Tables leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Spring Boot Admin | <=a2d5310f44fd46780a8686456cf2f9001ab8f024 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3413?
CVE-2025-3413 is classified as critical due to its potential impact.
How do I fix CVE-2025-3413?
To mitigate CVE-2025-3413, update opplus springboot-admin to a version newer than a2d5310f44fd46780a8686456cf2f9001ab8f024.
What is the impact of CVE-2025-3413?
CVE-2025-3413 could lead to deserialization vulnerabilities that may allow an attacker to execute arbitrary code.
Which versions are affected by CVE-2025-3413?
CVE-2025-3413 affects versions of opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024.
What component is vulnerable in CVE-2025-3413?
The vulnerable component in CVE-2025-3413 is the SysGeneratorController.java function.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/description
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/references
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- agent/tags
- vendor/opplus
- canonical/spring boot admin