linlinjava litemall JSON Web Token JwtHelper.java hard-coded credentials_CVE-2025-8974

6.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Description

A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the input X-Litemall-Token leads to hard-coded credentials. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Basic Information

ID CVE-2025-8974

Source VulDB

Published Aug 14, 2025 at 18:02

Affected Product

Vendor linlinjava

Product litemall

Version 1.0

Affected Versions linlinjava litemall 1.0
linlinjava litemall 1.1
linlinjava litemall 1.2
linlinjava litemall 1.3
linlinjava litemall 1.4
linlinjava litemall 1.5
linlinjava litemall 1.6
linlinjava litemall 1.7
linlinjava litemall 1.8.0

CWE Classification

CWE-798 CWE-259

References

{
    "lastseen": "",
    "description": "A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the input X-Litemall-Token leads to hard-coded credentials. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.",
    "published": "2025-08-14T18:02:08.547Z",
    "modified": "2025-08-14T18:02:08.547Z",
    "type": "cve",
    "title": "linlinjava litemall JSON Web Token JwtHelper.java hard-coded credentials",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.319970\nhttps://vuldb.com/?ctiid.319970\nhttps://vuldb.com/?submit.628233\nhttps://github.com/linlinjava/litemall/issues/568\nhttps://github.com/linlinjava/litemall/issues/568#issue-3289860066",
    "id": "CVE-2025-8974",
    "bulletinFamily": "",
    "cwe": [
        "CWE-798",
        "CWE-259"
    ],
    "cvelist": null,
    "sourceData": "linlinjava litemall 1.0\nlinlinjava litemall 1.1\nlinlinjava litemall 1.2\nlinlinjava litemall 1.3\nlinlinjava litemall 1.4\nlinlinjava litemall 1.5\nlinlinjava litemall 1.6\nlinlinjava litemall 1.7\nlinlinjava litemall 1.8.0",
    "sourceHref": "",
    "cvss": {
        "score": 6.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "litemall",
    "version": "1.0",
    "vendor": "linlinjava",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}