CVE-2025-3567 veal98 小牛肉 Echo 开源社区系统 Ticket LoginTicketInterceptor.java preHandle improper authorization
Remote attackers can bypass authorization checks in the Ticket Handler of the Echo community system due to improper implementation in the preHandle function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-3567?
CVE-2025-3567 is a medium-severity missing authorization vulnerability in veal98 小牛肉 Echo 开源社区系统, published on 14 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability, which was classified as problematic, was found in veal98 小牛肉 Echo 开源社区系统 4.2. Affected is the function preHandle of the file src/main/java/com/greate/community/controller/interceptor/LoginTicketInterceptor.java of the component Ticket Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-3567?
How do I fix CVE-2025-3567?
No fix has been published for CVE-2025-3567 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-3567 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3567 exists.
Sources
Also known as GHSA-cp5g-5x6r-cmw3.