CVE-2025-43955

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

CVSS v3 2.2 LOW

2.2^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/convertigo/convertigo/blob/8.3.11/CHANGELOG.md#8311	Release Notes
https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1	Patch
https://github.com/convertigo/convertigo/issues/898	Exploit Issue Tracking
https://github.com/convertigo/convertigo/releases/tag/8.3.11	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:convertigo:convertigo:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-20 20:15

Updated : 2026-08-28 15:51

NVD link : CVE-2025-43955

Mitre link : CVE-2025-43955

CVE.ORG link : CVE-2025-43955

JSON object : View

Products Affected

convertigo

convertigo

CWE

CWE-749

Exposed Dangerous Method or Function

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2025-43955", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43955", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-21T13:28:00.937350Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Convertigo", "product": "Convertigo", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.3.4"}], "defaultStatus": "unknown"}]}], "published": "2025-04-20T20:15:13.553", "references": [{"url": "https://github.com/convertigo/convertigo/blob/8.3.11/CHANGELOG.md#8311", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/convertigo/convertigo/commit/431d1bfeb360a55f4ed299cc3aa287cc5c6357e1", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/convertigo/convertigo/issues/898", "tags": ["Exploit", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/convertigo/convertigo/releases/tag/8.3.11", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-749"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts."}, {"lang": "es", "value": "TwsCachedXPathAPI en Convertigo hasta 8.3.4 no restringe el uso de las API commons-jxpath."}], "lastModified": "2026-08-28T15:51:06.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:convertigo:convertigo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EF35EA4-0CE8-430D-9D99-5F4ACE24B0A3", "versionEndExcluding": "8.3.11"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}