MEDIUM🇬🇧 English

CVE-2025-25069

CVSS 6.5v3.1pub. 2025-02-07upd. 2025-07-16

A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF. It is similiar to CVE-2016-10517 in Redis. This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.11.1, which fixes the issue.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

  • Apache Kvrocks

    APP
    Apache
    < 2.11.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SSRF
CWE
Referencje

Powiązane podatności

CVE-2025-26413HIGH7.5ten sam produkt

Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` ...

CVE-2025-59790MEDIUM5.4ten sam produkt

Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0...

CVE-2025-59792MEDIUM5.3ten sam produkt

Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apac...

CVE-2025-24813CRITICAL9.8⚠ KEVPL ✓ten sam vendor

Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych

CVE-2024-38856CRITICAL9.8⚠ KEVPL ✓ten sam vendor

Apache OFBiz — nieautoryzowane wykonanie kodu przez błędną autoryzację