CVE-2025-35432

Mô tả

Tham khảo

• cisagov/thorium commit 7c94a0b · Patch
• cisagov/thorium release 1.1.1 · Release Notes
• raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json · Vendor Advisory
• cve.org/CVERecord · Third Party Advisory

Lỗ hổng khác của thorium

• CVE-2025-35436CAO 7.5CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could caus…
• CVE-2025-35435TRUNG BÌNH 4.3CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to cra…
• CVE-2025-35434NGHIÊM TRỌNG 9.8CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium clust…
• CVE-2025-35433CAO 8.8CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used toke…
• CVE-2025-35431TRUNG BÌNH 5.4CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization da…