imported>Fspinar Created page with "{| class="wikitable" |+ ! ! |- |Date |2025-09-18 |- |Severity |reported "critical", BlueSpice assessment: '''low''' |- |Affected | Services in current LTS version 5.1 |- |Fixed in |fix not yet available |- |CVE | [https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988], [https://avd.aquasec.com/nvd/2025/cve-2025-7783 CVE-2025-7783], [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050], [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794], [https://a..." |
imported>Mglaser No edit summary |
||
| (5 intermediate revisions by 2 users not shown) | |||
| Line 5: | Line 5: | ||
|- | |- | ||
|Date | |Date | ||
|2025-09 | |2025-12-09 | ||
|- | |- | ||
|Severity | |Severity | ||
| Line 11: | Line 11: | ||
|- | |- | ||
|Affected | |Affected | ||
| Services in current LTS version 5.1 | | Services in current LTS version < 5.1.4 | ||
|- | |- | ||
|Fixed in | |Fixed in | ||
| | |5.1.4 | ||
|- | |- | ||
|CVE | |CVE | ||
| | | [https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516] | ||
|} | |} | ||
==Problem== | ==Problem== | ||
* Service <code>bluespice/search</code>- [https://nvd.nist.gov/vuln/detail/CVE-2025- | * Service <code>bluespice/search</code>- [https://nvd.nist.gov/vuln/detail/CVE-2025-66516 CVE-2025-66516] | ||
==Impact assessment== | ==Impact assessment== | ||
* Service <code>bluespice/search</code> | * Service <code>bluespice/search</code> | ||
** A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system. | ** A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system. | ||
== Solution == | == Solution == | ||
To mitigate <code>CVE-2025- | To mitigate <code>CVE-2025-66516</code> , make sure the service has no access to the internet. This is the default configuration of BlueSpice setups. | ||
Update to version 5.1.4 of the BlueSpice images. | |||
Latest revision as of 08:03, 10 December 2025
| Date | 2025-12-09 |
| Severity | reported "critical", BlueSpice assessment: low |
| Affected | Services in current LTS version < 5.1.4 |
| Fixed in | 5.1.4 |
| CVE | CVE-2025-66516 |
Problem
- Service
bluespice/search- CVE-2025-66516
Impact assessment
- Service
bluespice/search- A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system.
Solution
To mitigate CVE-2025-66516 , make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.
Update to version 5.1.4 of the BlueSpice images.
