« Volver al listado

CVE-2025-22390

Estado: AnalizadaAlta (7.5)—

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate complexity to resist modern attack techniques such as password spraying or offline password cracking.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/AC:L/PR:N permite explotación remota (T1190), pero la vulnerabilidad es débil validación de contraseñas; C:H sugiere acceso a datos. El impacto principal es obtención de cuentas válidas (T1078) mediante cracking offline de passwords de 6 caracteres; T1110 (brute force) es secundario dado el con

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementPrivileged Account ManagementPassword PoliciesMulti-factor AuthenticationAccount Use PoliciesApplication Developer Guidance

Tecnologías afectadas (1)

Optimizely — Optimizely CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22390",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22390",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-06T16:59:09.939308Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-04T02:15:07.747",
  "references": [
    {
      "url": "https://support.optimizely.com/hc/en-us/articles/33182255281293-Content-Management-System-CMS-Security-Advisory-CMS-2025-02",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-521"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-521"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate complexity to resist modern attack techniques such as password spraying or offline password cracking."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Optimizely EPiServer.CMS.Core antes de la versión 12.32.0. Existe una vulnerabilidad de gravedad media en el CMS debido a la aplicación insuficiente de los requisitos de complejidad de las contraseñas. La aplicación permite a los usuarios establecer contraseñas con una longitud mínima de 6 caracteres, lo que no es lo suficientemente complejo como para resistir las técnicas de ataque modernas, como la pulverización de contraseñas o el descifrado de contraseñas sin conexión."
    }
  ],
  "lastModified": "2026-06-17T08:46:59.383",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:optimizely:optimizely_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "549BAD9C-4AA0-4338-9B3D-6038E7151FBC",
              "versionEndExcluding": "12.32.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}