Last edited 7 months ago
by Anonymous user

Security:Security Advisories/BSSA-2026-02: Difference between revisions

Back to version history
Browse history interactively
Newer edit →

imported>Rvogel1

VisualWikitext
imported>Rvogel1
Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-01-29 |- |Severity |reported "high", BlueSpice assessment: '''low''' |- |Affected | Services in current LTS version < 5.1.4 |- |Fixed in | |- |CVE | * [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847] * [https://avd.aquasec.com/nvd/2025/cve-2025-15467/ CVE-2025-15467] |} ==Problem== {| class="wikitable" !'''CVE''' !'''Component''' !'''Type of vulnerability''' !'''BlueSpice 5''' !'''BlueSpice 4''' |- |CVE-2025-148..."
 
imported>Rvogel1
No edit summary
Line 11: Line 11:
|-
|-
|Affected
|Affected
| Services in current LTS version < 5.1.4
| Services in LTS version < 5.1.5
BlueSpice PRO/FARM < 5.1.5
BlueSpice PRO/FARM < 5.2.0
|-
|-
|Fixed in
|Fixed in
|
|BlueSpice PRO/FARM 5.1.4
BlueSpice PRO/FARM 5.2.1
|-
|-
|CVE
|CVE
|
|
* [https://avd.aquasec.com/nvd/2025/cve-2025-14847 CVE-2025-14847]
* [https://avd.aquasec.com/nvd/2025/cve-2025-15467/ CVE-2025-15467]
* [https://avd.aquasec.com/nvd/2025/cve-2025-15467/ CVE-2025-15467]
* [https://avd.aquasec.com/nvd/2026/cve-2026-24732 CVE-2026-24732]
|}
|}


Line 29: Line 32:
!'''BlueSpice 5'''
!'''BlueSpice 5'''
!'''BlueSpice 4'''
!'''BlueSpice 4'''
|-
|CVE-2025-14847
|<code>container collabpads-database(image:mongo:8.0)</code>
|Information Disclosure
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
|-
|-
|CVE-2025-15467
|CVE-2025-15467
Line 41: Line 38:
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-24732
|
|Information Disclosure
| style="" class="col-purple-bg" |affected
| style="" class="col-green-bg" |not affected
|}
|}


==Impact assessment==
==Impact assessment==
* Service <code>collabpads-database</code> (image name: <code>mongo</code> )
** A unauthenticated MongoDB client can attack the service if reachable.  By default BlueSpice setup, the service runs only in the background and can not be accessed from outside the virtual network. So not even unauthenticated access is possible from any external location.
{| class="wikitable" style="width: 100%;"
{| class="wikitable" style="width: 100%;"
!CVE
!CVE
Line 51: Line 52:
!Mitigation without update
!Mitigation without update
|-
|-
| style="vertical-align:middle;text-align:left;" |CVE-2025-14847
| style="vertical-align:middle;text-align:left;" |CVE-2025-15467
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Low
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Low
| style="vertical-align:middle;text-align:left;" |Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
| style="vertical-align:middle;text-align:left;" |Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
|-
|-
|CVE-2025-15467
|CVE-2026-24732
| style="" class="col-orange-bg" |Low
| style="" class="col-purple-bg" |Medium
|Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
|None
|}
|}


== Solution ==
== Solution ==
To mitigate <code>CVE-2025-14847</code> use one of the following options:
To mitigate <code>CVE-2026-24732</code> , please update to
 
# Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.
# Update the <code>mongo</code> docker image via BlueSpice's deploy tool: <code>bluespice-deploy pull collabpads-database && bluespice-deploy up -d</code>

Revision as of 13:00, 4 March 2026

Date 2026-01-29
Severity reported "high", BlueSpice assessment: low
Affected Services in LTS version < 5.1.5

BlueSpice PRO/FARM < 5.1.5 BlueSpice PRO/FARM < 5.2.0

Fixed in BlueSpice PRO/FARM 5.1.4

BlueSpice PRO/FARM 5.2.1

CVE

Problem

CVE Component Type of vulnerability BlueSpice 5 BlueSpice 4
CVE-2025-15467 Container bluespice/database Buffer Overflow affected affected
CVE-2026-24732 Information Disclosure affected not affected

Impact assessment

CVE Assessment Mitigation without update
CVE-2025-15467 Low Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups
CVE-2026-24732 Medium None

Solution

To mitigate CVE-2026-24732 , please update to

Retrieved from "https://galaxy.demo.bluespice.com/Helpdesk/index.php?title=Security:Security_Advisories/BSSA-2026-02&oldid=11246"