CVE-2025-55368: High severity jshERP jshERP vulnerability

Published Aug 21, 2025

Updated

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

Affected Software

2 affected components

jshERP jshERP

jishenghua jshERP=3.5

Event History

Aug 21, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-55368?

CVE-2025-55368 is considered to have a high severity due to its potential for unauthorized access and modifications.

How do I fix CVE-2025-55368?

To fix CVE-2025-55368, ensure proper access controls are implemented in the RoleController.java to restrict modifications to authorized users only.

Who is affected by CVE-2025-55368?

CVE-2025-55368 affects users of jshERP v3.5, specifically in the RoleController component.

What are the consequences of CVE-2025-55368?

The consequence of CVE-2025-55368 is that unauthorized attackers can modify supplier statuses across different accounts, compromising data integrity.

What is the nature of the vulnerability in CVE-2025-55368?

CVE-2025-55368 involves incorrect access controls that allow unauthorized modifications to occur in the jshERP application.