wisdom-education CVE-2025-11321

Q: What is the CVSS score of CVE-2025-11321?

CVE-2025-11321 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Authorization (CWE-285)

2025-10-06 cna@vuldb.com

Java Authentication Bypass

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:00 vuln.today

DescriptionCVE.org

A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subjectId results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Authorization bypass in zhuimengshaonian wisdom-education up to version 1.0.4 allows authenticated remote attackers to manipulate the subjectId parameter in WrongBookController.java to access unauthorized resources. The vulnerability has a low CVSS score (2.1) due to limited confidentiality impact and requirement for prior authentication, but publicly available exploit code exists and the attack vector is entirely network-accessible.

Technical ContextAI

The vulnerability exists in the WrongBookController.java file within the student API endpoint module of the wisdom-education Java application. The root cause is classified as CWE-285 (Improper Authorization), indicating insufficient validation of the subjectId parameter before granting access to protected functions. The application fails to properly verify that the authenticated user has authorization to access resources associated with the manipulated subjectId value, allowing privilege escalation within the same authentication context.

Affected ProductsAI

zhuimengshaonian wisdom-education versions up to and including 1.0.4 are affected. The specific vulnerable component is the WrongBookController.java file in the student API module (src/main/java/com/education/api/controller/student/WrongBookController.java). CPE data was not provided in available intelligence sources.

RemediationAI

Upgrade zhuimengshaonian wisdom-education to a patched version greater than 1.0.4 if available from the vendor. The primary fix is to implement server-side authorization checks in WrongBookController.java to verify that the authenticated user's permission scope includes access to the requested subjectId before processing the request. As a compensating control, restrict network access to the WrongBookController endpoints to trusted internal networks only, reducing the effective attack surface from network-accessible to local-network-only. Additionally, implement input validation to reject subjectId parameters that fall outside the authenticated user's assigned subject roster. Monitor access logs for unusual subjectId access patterns across different users to detect exploitation attempts.