CVE-2025-35939

Estado: AnalizadaMedia (6.9)⚠ Explotación activa

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 6.9

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.35%
Percentil entre todas las CVEs puntuadas: 71
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 2/6/2025
Plazo de remediación: 23/6/2025
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto secundarioT1552.001 Credentials In Filescredential access70 %

Vulnerabilidad en aplicación web expuesta (CMS accesible sin autenticación) que permite inyectar código PHP en archivos de sesión. AV:N/PR:N/UI:N confirma explotabilidad remota sin privilegios. Permite ejecución de comandos via PHP y acceso a datos de sesión.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning User Training Restrict File and Directory Permissions Privileged Account Management Password Policies Network Segmentation

Tecnologías afectadas (1)

Craftcms — Craft CMS

CWE

CWE-472
NVD-CWE-Other

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-35939",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "ssvcData": {
          "id": "CVE-2025-35939",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-07T22:40:17.180919Z"
        }
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-35939",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-06T03:55:25.568262Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "affectedData": [
        {
          "vendor": "Craft",
          "product": "CMS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.7.5",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "5.7.5"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.15.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "4.15.3"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-05-07T23:15:54.103",
  "references": [
    {
      "url": "https://github.com/craftcms/cms/pull/17220",
      "tags": [
        "Patch"
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://github.com/craftcms/cms/releases/tag/4.15.3",
      "tags": [
        "Release Notes"
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://github.com/craftcms/cms/releases/tag/5.7.5",
      "tags": [
        "Release Notes"
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-147-01.json",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-35939",
      "tags": [
        "VDB Entry"
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-35939",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "description": [
        {
          "lang": "en",
          "value": "CWE-472"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue."
    },
    {
      "lang": "es",
      "value": "Craft CMS almacena contenido arbitrario proporcionado por usuarios no autenticados en archivos de sesión. Este contenido podría ser accedido y ejecutado, posiblemente aprovechando una vulnerabilidad independiente. Craft CMS redirige las solicitudes que requieren autenticación a la página de inicio de sesión y genera un archivo de sesión en el servidor, en `/var/lib/php/sessions`. Estos archivos de sesión se denominan `sess_[session_value]`, donde `[session_value]` se proporciona al cliente en un encabezado de respuesta `Set-Cookie`. Craft CMS almacena la URL de retorno solicitada por el cliente sin parámetros de limpieza. Por lo tanto, un cliente no autenticado puede introducir valores arbitrarios, como código PHP, en una ubicación de archivo local conocida en el servidor. Se han publicado las versiones 5.7.5 y 4.15.3 de Craft CMS para solucionar este problema."
    }
  ],
  "lastModified": "2026-06-17T09:14:18.460",
  "cisaActionDue": "2025-06-23",
  "cisaExploitAdd": "2025-06-02",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C8B256D-000B-4588-8182-CEC2ACC076EB",
              "versionEndExcluding": "4.15.3"
            },
            {
              "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61BCA33B-AEA5-45AA-A757-9348C48A4728",
              "versionEndExcluding": "5.7.5",
              "versionStartIncluding": "5.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability"
}