CVE-2025-13283

TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, which poses a potential risk of information leakage or could consume hard drive space by copying files in large volumes.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.twcert.org.tw/en/cp-139-10511-10f3a-2.html	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-10510-3719c-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cht:tenderdoctransfer:*:*:*:*:*:*:*:*

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) TenderDocTransfer desarrollado por Chunghwa Telecom tiene una vulnerabilidad de copia y pegado arbitrario de archivos. La aplicación configura un simple servidor web local y proporciona APIs para la comunicación con el sitio web objetivo. Debido a la falta de protección CSRF en las APIs, atacantes remotos no autenticados podrían usar estas APIs a través de phishing. Además, una de las APIs contiene una vulnerabilidad de salto de ruta absoluto. Los atacantes pueden copiar archivos arbitrarios en el sistema del usuario y pegarlos en cualquier ruta, lo que representa un riesgo potencial de fuga de información o podría consumir espacio en el disco duro al copiar archivos en grandes volúmenes.

Information

Published : 2025-11-17 04:15

Updated : 2026-10-07 21:10

NVD link : CVE-2025-13283

Mitre link : CVE-2025-13283

CVE.ORG link : CVE-2025-13283

JSON object : View

Products Affected

cht

tenderdoctransfer

CWE

CWE-36

Absolute Path Traversal

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-13283", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13283", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-17T16:36:24.267032Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "twcert@cert.org.tw", "affectedData": [{"vendor": "Chunghwa Telecom", "product": "TenderDocTransfer", "versions": [{"status": "affected", "version": "0", "lessThan": "0.41.159", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-17T04:15:54.800", "references": [{"url": "https://www.twcert.org.tw/en/cp-139-10511-10f3a-2.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-10510-3719c-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-36"}, {"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, which poses a potential risk of information leakage or could consume hard drive space by copying files in large volumes."}, {"lang": "es", "value": "TenderDocTransfer desarrollado por Chunghwa Telecom tiene una vulnerabilidad de copia y pegado arbitrario de archivos. La aplicaci\u00f3n configura un simple servidor web local y proporciona APIs para la comunicaci\u00f3n con el sitio web objetivo. Debido a la falta de protecci\u00f3n CSRF en las APIs, atacantes remotos no autenticados podr\u00edan usar estas APIs a trav\u00e9s de phishing. Adem\u00e1s, una de las APIs contiene una vulnerabilidad de salto de ruta absoluto. Los atacantes pueden copiar archivos arbitrarios en el sistema del usuario y pegarlos en cualquier ruta, lo que representa un riesgo potencial de fuga de informaci\u00f3n o podr\u00eda consumir espacio en el disco duro al copiar archivos en grandes vol\u00famenes."}], "lastModified": "2026-10-07T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cht:tenderdoctransfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E474265-3B59-4B3C-AAAD-87E8F1C7995C", "versionEndExcluding": "0.41.159"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}