CVE-2025-10247
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability was detected in JEPaaS 7.2.8 affecting the doFilterInternal function of the Filter Handler component, leading to improper access controls. The attack can be executed remotely and the exploit has been publicly disclosed; the vendor did not respond.
Risk Assessment
Potential bypass of access control mechanisms and unauthorized access to functions or data. The public exploit increases exploitation risk.
Recommendation
Apply patches or mitigations restricting access to the Filter Handler component. Review access control logic in doFilterInternal and monitor for suspicious requests.
Other vulnerabilities in JEPaaS
See all- CVE-2025-15088Medium
A vulnerability was detected in JEPaaS up to 7.2.8 in the postilService.loadPostils function of /je/postil/postil/loadPostil. Manipulation of the keyWord argument results in SQL injection, and remote exploitation is possible. The exploit is now public and may be used.
- CVE-2025-14694Medium
A vulnerability was found in ketr JEPaaS up to 7.2.8. It impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. Manipulation of the argument keyWord results in SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early but did not respond.
Original NVD description (English source)
A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS