CVE-2025-55367: Medium severity jshERP jshERP vulnerability

Published Aug 21, 2025

Updated

Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

Affected Software

2 affected components

jshERP jshERP

jishenghua jshERP=3.5

Event History

Aug 21, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-55367?

CVE-2025-55367 is classified as a high severity vulnerability due to its potential impact on unauthorized access and modification of supplier statuses.

How do I fix CVE-2025-55367?

To fix CVE-2025-55367, ensure proper access controls are implemented in the SupplierController.java to restrict unauthorized user actions.

What is affected by CVE-2025-55367?

CVE-2025-55367 affects the jshERP v3.5 software version specifically.

Who can exploit CVE-2025-55367?

Any unauthorized attacker can exploit CVE-2025-55367 to modify supplier statuses under any account due to incorrect access control.

What should I do if I am using jshERP v3.5 and concerned about CVE-2025-55367?

If you are using jshERP v3.5, it is crucial to review your access control configurations and apply the necessary updates to prevent exploitation of CVE-2025-55367.