CVE-2025-64781

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website when accessing a specially crafted URL.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://groupsession.jp/info/info-news/security20251208	Vendor Advisory
https://jvn.jp/en/jp/JVN19940619/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:groupsession:groupsession:::::bycloud:::*
	cpe:2.3:a:groupsession:groupsession:::::free:::*
	cpe:2.3:a:groupsession:groupsession:::::zion:::*

History

01 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) En GroupSession Free edition anterior a la ver5.7.1, GroupSession byCloud anterior a la ver5.7.1, y GroupSession ZION anterior a la ver5.7.1, 'Restricción de visualización de página externa' está configurado como 'No limitar' en la configuración inicial. Con esta configuración, el usuario puede ser redirigido a un sitio web arbitrario al acceder a una URL especialmente diseñada.

Information

Published : 2025-12-12 05:16

Updated : 2026-10-07 20:10

NVD link : CVE-2025-64781

Mitre link : CVE-2025-64781

CVE.ORG link : CVE-2025-64781

JSON object : View

Products Affected

groupsession

groupsession

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2025-64781", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64781", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T20:25:44.579958Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession Free edition", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession byCloud", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}, {"vendor": "Japan Total System Co.,Ltd.", "product": "GroupSession ZION", "versions": [{"status": "affected", "version": "prior to ver5.7.1"}]}]}], "published": "2025-12-12T05:16:11.623", "references": [{"url": "https://groupsession.jp/info/info-news/security20251208", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN19940619/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, \"External page display restriction\" is set to \"Do not limit\" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website when accessing a specially crafted URL."}, {"lang": "es", "value": "En GroupSession Free edition anterior a la ver5.7.1, GroupSession byCloud anterior a la ver5.7.1, y GroupSession ZION anterior a la ver5.7.1, 'Restricci\u00f3n de visualizaci\u00f3n de p\u00e1gina externa' est\u00e1 configurado como 'No limitar' en la configuraci\u00f3n inicial. Con esta configuraci\u00f3n, el usuario puede ser redirigido a un sitio web arbitrario al acceder a una URL especialmente dise\u00f1ada."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:bycloud:*:*:*", "vulnerable": true, "matchCriteriaId": "0023BDD1-63A1-4F4B-A949-7B5687512F86", "versionEndExcluding": "5.7.1"}, {"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:free:*:*:*", "vulnerable": true, "matchCriteriaId": "41253C33-6699-4FE8-80B5-917FF6F71E65", "versionEndExcluding": "5.7.1"}, {"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:zion:*:*:*", "vulnerable": true, "matchCriteriaId": "428C47F8-9B26-4902-80C5-2E6A9D09B28E", "versionEndExcluding": "5.7.1"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}