CVE-2025-11337
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Manipulation of the fileName argument in the file /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do results in path traversal. The attack can be initiated remotely and the exploit is now public.
Risk Assessment
The vulnerability allows remote reading of arbitrary files on the server, potentially leaking configuration or other sensitive data. The vendor's lack of response makes obtaining an official fix difficult.
Recommendation
Immediately restrict access to the platform interface from untrusted networks, validate the fileName argument server-side, and consider WAF rules to block path traversal attempts. Contact the vendor for a patch.
Other vulnerabilities in Four-Faith Water Conservancy Informatization Platform
See all- CVE-2025-11336Medium
A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Manipulation of the fileName argument in the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do leads to path traversal. The attack may be performed remotely and the exploit has been disclosed publicly.
- CVE-2025-11018Medium
A vulnerability in Four-Faith Water Conservancy Informatization Platform 1.0 affects an unknown function in /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Manipulation of the fileName argument leads to path traversal. The attack can be launched remotely and the exploit is public.
- CVE-2025-10709Medium
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. This affects an unknown part of the file /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS