Vulnerability · Published Feb 7, 2025 · Assigned by INCIBE

CVE-2025-1108Insufficient data authenticity vulnerability in Janto

High 8.6

In plain English

A high-severity insufficient verification of data authenticity in Janto from Impronta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into the ‘Xml’ parameter on the ‘/public/cgi/Gateway.php’ endpoint.

Affected products (as reported)

Vendor	Product	Versions
Impronta	Janto	0 – before r12

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto