Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a views dashboard with a custom background using the `data:image/png;base64` protocol that could potentially lead to an unvalidated redirect. This behavior circumvents the Splunk external URL warning mechanism by using a specially crafted URL, allowing for a redirection to an external malicious site. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
A security vulnerability in opsre go-ldap-admin (CVSS 5.6). Remediation should follow standard vulnerability management procedures.
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.
A security vulnerability in Timetable and Event Schedule by MotoPress WordPress (CVSS 2.7). Remediation should follow standard vulnerability management procedures.
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability `admin_all_objects` could craft a malicious payload through the href attribute of an anchor tag within a collection in the navigation bar, which could result in execution of unauthorized JavaScript code in the browser of a user.
We need to produce a JSON object with the specified fields, strictly as plain text strings, no nesting. We must synthesize all provided data, cross-reference, and produce an original analysis. First, gather all info: CVE: CVE-2025-13949 Product: ProudMuBai GoFilm 1.0.0/1.0.1 Description: A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1. Impacted is the function SingleUpload of the file /server/controller/FileController.go. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 2.1 (CVSS 4.0 score, but the vector is 4.0. We need to output both assessed CVSS 3.1 and 4.0 vectors, independent assessment. The provided CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. That's a low base score 2.1? Actually CVSS:4.0 base score with VC:L/VI:L/VA:L might be low. But we'll assess independently. Also, EPSS: 0.05% (15th percentile) – very low exploitation probability. KEV: not mentioned, so no active known exploitation. Tags: File Upload, Authentication Bypass. CWE: CWE-284 (Improper Access Control). Affected versions: GoFilm 1.0.1, 1.0.0. POC: exploit publicly available (description says "exploit is publicly available"). Vendor not responding. Now answer each field: product_name: "GoFilm" (specific product, 1-3 words). Possibly "GoFilm" alone, since vendor ProudMuBai, but product name is GoFilm. So: "GoFilm". summary: Start with impact verb and product. Unrestricted file upload. So: "Unrestricted file upload in GoFilm 1.0.0 and 1.0.1 allows remote attackers to upload arbitrary files via the SingleUpload function. The vulnerability has publicly available exploit code and has been reported to the vendor without response." Must note active exploitation? No KEV, so not actively exploited. Mention EPSS very low (0.05%) if notable. No specific mention of active exploitation. So: "Unrestricted file upload in GoFilm 1.0.0 and 1.0.1 allows remote attackers to upload arbitrary files via the SingleUpload function. Public exploit code is available; the EPSS exploitation probability is 0.05%, indicating low likelihood of widespread exploitation. The vendor has not responded to the disclosure." Avoid copying description. Original synthesis. technical_context: Underlying tech: GoFilm is an unspecified software (likely a media/film management system). CWE-284 Improper Access Control, file upload parameter "File" is not properly sanitized/restricted. CPE? Not provided, but product is GoFilm. No CPE strings. Use CWE to explain root cause: improper access control leading to unrestricted file upload. Be educational: "The vulnerability resides in the file upload handler of GoFilm's web interface, exposing the /server/controller/FileController.go endpoint. The root cause is classified as CWE-284 (Improper Access Control), indicating missing or insufficient restrictions on file type, size, or path. This allows an authenticated user (PR:L) to upload arbitrary files, which could lead to remote code execution or server compromise." Need to infer from CVSS vector: AV:N, PR:L (low privileges). So authenticated. So the upload function is accessible by low-privilege users. So technical_context: "GoFilm is a web application written in Go. The vulnerability is in the SingleUpload function in FileController.go, which handles file uploads. This function lacks proper validation of uploaded file types or extensions, enabling an attacker with low-privilege access (PR:L) to upload arbitrary files, such as web shells. The CWE-284 (Improper Access Control) classification indicates the missing access controls on file upload operations." risk_assessment: Use CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) with exploit available (E:P). EPSS 0.05% (very low). KEV not listed. Public exploit exists. SSVC: exploitation status: public POC (no confirmed active exploitation). Automatable? Probably yes (simple HTTP request). Technical impact: partial (VC:L/VI:L/VA:L) meaning low confidentiality, integrity, availability impact. But unrestricted file upload often leads to higher impact if combined with other vulnerabilities, but as given, low. So real risk: low, likely because attacker needs authentication (PR:L) and exploit yields low impacts. EPSS reinforces low. Compare: CVSS base score is low, but with E:P it might be mid. But overall, low priority, especially with no known active exploitation. State conflicting signals? "Although the attack vector is network-based and complexity low, the need for low-privilege authentication limits the attack surface, and the assessed impact is low. The EPSS score is very low, suggesting minimal real-world exploitation likelihood despite public exploit availability." Also note vendor hasn't responded, patch status unknown. So: "The vulnerability has a low CVSS 4.0 base score (2.1) due to low impact metrics and requires low-privilege authentication. EPSS probability is 0.05%, indicating negligible exploitation likelihood. However, the availability of public exploit code and the potential for file upload to be leveraged for further compromise should be considered. No active exploitation is reported. This is low risk unless the product is widely deployed in sensitive environments." affected_products: "GoFilm versions 1.0.0 and 1.0.1 are affected, per EUVD. No CPE details provided. Vendor advisory not available. References: issue tracker at github.com/yzlala1147/cve/issues/1 and VulDB entry at vuldb.com/?id.334164." Must link to advisory if possible, but no vendor advisory. So: "GoFilm 1.0.0 and 1.0.1 are confirmed affected. No vendor advisory is available; vulnerability disclosed on GitHub issue #1 and VulDB entry 334164." remediation: Primary fix: none mentioned. Vendor not responding. So "No patch is available; the vendor ProudMuBai has not responded to disclosure." Workarounds: "As a temporary mitigation, restrict access to the file upload endpoint by IP address, disable the SingleUpload functionality if not needed, or enforce strict file type validation via a web application firewall. The trade-off: functionality may be limited. No patch version is available, and any fix must come from the vendor. Monitor the GitHub issue for updates." Avoid generic "apply defense in depth" — specific: disable endpoint, restrict access. I'll state: "If the SingleUpload endpoint is not required, disable it or restrict network access to the endpoint to trusted IPs. Alternatively, deploy a web application firewall rule to block file uploads with dangerous extensions (e.g., .php, .jsp, .exe). This may impact legitimate uploads. No vendor patch exists at this time." exploit_scenario: "An authenticated low-privilege attacker sends a crafted HTTP POST request to the /server/controller/FileController.go SingleUpload endpoint with a malicious file (e.g., a web shell) as the 'File' argument. The server accepts and stores the file without validation, enabling remote code execution when the file is later accessed. Public exploit code exists for this vulnerability." exploitation_conditions: Need specific prerequisites: description says manipulation of argument File leads to unrestricted upload. Function SingleUpload. So condition: "The attacker must be authenticated with low privileges on the GoFilm web application. The SingleUpload endpoint must be accessible without additional restrictions. No special configuration is required beyond default deployment." However, CVSS vector has PR:L, so authenticated. So condition: "Low-privilege authentication to the GoFilm web interface is required. The file upload endpoint /server/controller/FileController.go via SingleUpload function must be exposed. No special configuration; the vulnerability is present by default." No user interaction needed. Good. attack_chain: Steps: Recon? Not necessary. Access -> Delivery -> Exploit -> Execution -> Impact. So: "Obtain low-privilege credentials for GoFilm → Send malicious file via HTTP POST to SingleUpload endpoint → File accepted due to lack of validation → Access uploaded file to trigger code execution → Achieve remote code execution or further compromise." Could be shorter: "Authenticate with low-privilege account → Upload malicious file via SingleUpload → Execute uploaded file to gain code execution." I'll use 4 steps: "Authenticate with low-privilege credentials → Send crafted POST with malicious file to /server/controller/FileController.go → Unrestricted file upload stores the file on server → Access and execute the file for remote code execution." confidence_notes: "The vulnerability and its public exploit are confirmed by VulDB and GitHub issue reporters, but the vendor has not acknowledged or provided a patch. EPSS score and no KEV listing indicate no known active exploitation. Affected version range is confirmed by EUVD. The CVSS 4.0 vector is provided but may not reflect the full impact of unrestricted upload (often higher)." So: "Exploit publicly confirmed by VulDB and GitHub issue; no vendor response. EPSS low, no KEV listing, so no active exploitation. Exact impact beyond low may be higher with chained attacks, but official vector shows low impact. No patch available." That's specific. prevalence: Need to estimate real-world deployment. GoFilm by ProudMuBai: seems like a niche or small project, likely low usage. Not widespread. So "low". Basis: "niche Go-based web application with limited known deployments". So prevalence: "low", prevalence_basis: "niche Go-based film management software". Could also be "rare" if very obscure, but description says versions 1.0.0/1.0.1 so it's not retired. I'll go with "low". assessed_cvss_vector: My own independent assessment. Unrestricted file upload, remote, low privileges. Could lead to code execution, but that's not explicit; impact may be limited to upload only (if server doesn't execute files). Usually unrestricted upload leads to high impact if combined, but the official CVSS 4.0 says VC:L/VI:L/VA:L meaning low impact. I need to assess realistically. If upload is truly unrestricted, attacker can upload a web shell and get high impact. So I'd assess higher impact. But I need grounding in description: only says unrestricted upload, no mention of code execution. The CVSS 4.0 vector from VulDB indicates low impact. Since we are synthesizing and must be independent but grounded, I'll use a balanced approach: the vulnerability allows arbitrary file upload, but the actual impact depends on server configuration (e.g., if uploaded files are executable). So I'll set impact as high for integrity (upload) but confidentiality and availability might be low unless the server processes the files. Typically, unrestricted file upload is often scored with high integrity, high maybe confidentiality and availability if it leads to code execution. Many such vulnerabilities are rated as high. I'll set CV:? But to be consistent with the official low impact? The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." So I should derive from my understanding. I'll assume that arbitrary file upload leads to ability to upload malicious script and potentially execute it, so I'd give high impact. So AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. But is it always code execution? It might be limited to uploading arbitrary content, causing integrity high, maybe confidentiality none unless you can read files, but you might upload a script to read files. Usually, unrestricted upload is considered critical if you can achieve RCE. I'll set C:H, I:H, A:N (no availability impact). More conservative: C:L, I:H, A:L. I'll choose: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. Because you can upload a malicious file and potentially read some data (confidentiality low), integrity high, availability low (if you upload large files, maybe crash). But the official vector says all low, but that might be because they assess it only as allowing arbitrary file upload without execution. I'll go