20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160 SessionController.java list missing authentication

Summaryinfo

A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been declared as critical. The impacted element is the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. Such manipulation leads to missing authentication. This vulnerability is listed as CVE-2025-4015. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. The manipulation with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality.

The advisory is shared for download at cnblogs.com. This vulnerability is handled as CVE-2025-4015. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known.

The exploit is available at cnblogs.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• 20120630

Name

• Novel-Plus

Version

• 0e156c04b4b7ce0563bef6c97af4476fcda8f160

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #558367: 201206030 novel-plus commitID 0e156c04b4b7ce0563bef6c97af4476fcda8f160 broken function level authorization (by cnblogs.com)

Duplicate

• Submit #XXXXXX: Xxxxxxxx Xxxxx-xxxx Xxxxxxxx Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Xxxxxx Xxxxxxxx Xxxxx Xxxxxxxxxxxxx (by cnblogs.com)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion