imported>Mglaser Created page with "{| class="wikitable" |+ ! ! |- |Date |2025-12-09 |- |Severity |reported "critical", BlueSpice assessment: '''low''' |- |Affected | Services in current LTS version < 5.1.4 |- |Fixed in |5.1.4 |- |CVE | [https://avd.aquasec.com/nvd/2025/cve-2025-66516 CVE-2025-66516] |} ==Problem== * Service <code>bluespice/search</code>- [https://nvd.nist.gov/vuln/detail/CVE-2025-66516 CVE-2025-66516] ==Impact assessment== * Service <code>bluespice/search</code> ** A manipulated PDF fi..." |
imported>Rvogel1 Undo previous change; Will go into dedicated BSSA |
||
| (5 intermediate revisions by 3 users not shown) | |||
| Line 5: | Line 5: | ||
|- | |- | ||
|Date | |Date | ||
| | |2026-01-29 | ||
|- | |- | ||
|Severity | |Severity | ||
|reported " | |reported "high", BlueSpice assessment: '''low''' | ||
|- | |- | ||
|Affected | |Affected | ||
| Line 14: | Line 14: | ||
|- | |- | ||
|Fixed in | |Fixed in | ||
|5.1. | |5.2.1, 5.1.5 | ||
|- | |- | ||
|CVE | |CVE | ||
| [https://avd.aquasec.com/nvd/2025/cve-2025- | | [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847] | ||
|} | |} | ||
==Problem== | ==Problem== | ||
* Service <code>collabpads-database</code> (image name: <code>mongo</code> ) - [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847] | |||
==Impact assessment== | ==Impact assessment== | ||
* Service <code>collabpads-database</code> (image name: <code>mongo</code> ) | |||
* Service <code> | ** A unauthenticated MongoDB client can attack the service if reachable. By default BlueSpice setup, the service runs only in the background and can not be accessed from outside the virtual network. So not even unauthenticated access is possible from any external location. | ||
** A | |||
== Solution == | == Solution == | ||
To mitigate <code>CVE-2025- | To mitigate <code>CVE-2025-14847</code> use one of the following options: | ||
Update to version 5.1. | # Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups. | ||
# Update the <code>mongo</code> docker image via BlueSpice's deploy tool: <code>bluespice-deploy pull collabpads-database && bluespice-deploy up -d</code> | |||
# Update to version >=5.1.5 or >=5.2.1 of the BlueSpice images | |||
Latest revision as of 12:52, 4 March 2026
| Date | 2026-01-29 |
| Severity | reported "high", BlueSpice assessment: low |
| Affected | Services in current LTS version < 5.1.4 |
| Fixed in | 5.2.1, 5.1.5 |
| CVE | CVE-2025-14847 |
Problem
- Service
collabpads-database(image name:mongo) - CVE-2025-14847
Impact assessment
- Service
collabpads-database(image name:mongo)- A unauthenticated MongoDB client can attack the service if reachable. By default BlueSpice setup, the service runs only in the background and can not be accessed from outside the virtual network. So not even unauthenticated access is possible from any external location.
Solution
To mitigate CVE-2025-14847 use one of the following options:
- Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.
- Update the
mongodocker image via BlueSpice's deploy tool:bluespice-deploy pull collabpads-database && bluespice-deploy up -d - Update to version >=5.1.5 or >=5.2.1 of the BlueSpice images
