Vulnerability · Published Apr 8, 2025 · Assigned by VulDB

CVE-2025-3398lenve VBlog WebSecurityConfig.java configure access control

Medium 6.3

In plain English

A medium-severity improper access control in VBlog from lenve. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
lenve	VBlog	1.0

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-303643 | lenve VBlog WebSecurityConfig.java configure access control vdb-entry, technical-description
VDB-303643 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #525609 | VBlog 1.0.0 Improper Authentication third-party-advisory
https://magnificent-dill-351.notion.site/Improper-Authentication-Vulnerability-in-VBlog-1-0-0-1c0c693918ed80f2ace4fff7d1d51619 exploit