« Volver al listado

CVE-2025-54378

Estado: AnalizadaAlta (8.3)—

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto con PR:L para eludir autorización en endpoints API. Atacante autenticado modifica/accede recursos sin verificación de permisos (CWE-285, CWE-862).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Tecnologías afectadas (2)

PSU — Haxcms-nodejsPSU — Haxcms-php

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-54378",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54378",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-28T19:01:21.403243Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "haxtheweb",
          "product": "issues",
          "versions": [
            {
              "status": "affected",
              "version": "< 11.0.14"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-26T04:16:05.967",
  "references": [
    {
      "url": "https://github.com/haxtheweb/haxcms-nodejs/commit/5826e9b7f3d8c7c7635411768b86b199fad36969",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/haxtheweb/haxcms-php/commit/24d30222481ada037597c4d7c0a51a1ef7af6cfd",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php."
    },
    {
      "lang": "es",
      "value": "HAX CMS permite gestionar el universo de micrositios con backends PHP o NodeJs. En las versiones 11.0.13 y anteriores de haxcms-nodejs y 11.0.8 y anteriores de haxcms-php, los endpoints de la API no realizan comprobaciones de autorización al interactuar con un recurso. Tanto la versión JS como la PHP del CMS no verifican que un usuario tenga permiso para interactuar con un recurso antes de realizar una operación. Los endpoints de la API dentro de la aplicación HAX CMS comprueban si un usuario está autenticado, pero no comprueban la autorización antes de realizar una operación. Esto se ha corregido en las versiones 11.0.14 de haxcms-nodejs y 11.0.9 de haxcms-php."
    }
  ],
  "lastModified": "2026-06-17T09:39:57.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3129AEF5-B4C5-4694-AE1F-9A402890B1E5",
              "versionEndExcluding": "11.0.14"
            },
            {
              "criteria": "cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A74B72F-D438-44F9-9A3D-53CE9D8487A4",
              "versionEndExcluding": "11.0.9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}