CVE-2025-3413

MEDIUM

opplus springboot-admin - Deserialization of Untrusted Data via SysGeneratorController Tables Argument

Title source: llm
STIX 2.1

Description

A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerability is the function code of the file SysGeneratorController.java. The manipulation of the argument Tables leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.303691
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.303691
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.545374

Scores

CVSS v3 6.3
EPSS 0.0044
EPSS Percentile 35.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-20 CWE-502
Status published
Products (1)
opplus/springboot-admin < 2017-12-26
Published Apr 08, 2025
Tracked Since Feb 18, 2026