Mangati NovoSGA CVE-2025-11322

Remote unauthenticated access to the /novosga.users/new endpoint is required. The endpoint must permit user creation (not restricted to administrators). The application must have inadequate server-side validation of password field length and complexity. Exploitation is difficult (AC:H) because the attacker must know or guess valid usernames and navigate application-specific validation logic that may include CSRF tokens, rate limiting, or other anti-automation defenses. No authentication is required for the initial user creation request itself, but the attacker's ability to interact with the created account afterward depends on the login mechanism. If the system enforces a secondary approval step for new user accounts, exploitation is further limited. The impact is constrained to weak credentials enabling downstream compromise, not direct system compromise.

CVSS 2.9 with AC:H (Attack Complexity High) and low confidentiality impact (VC:L) indicate this is a low-severity vulnerability in isolation. EPSS score of 0.04% (percentile 12%) significantly reinforces low real-world exploitation probability, placing it well below median risk. The CVSSv4.0 vector shows AV:N (network-accessible) but the 'difficult to exploit' nature (reflected in AC:H) and limited impact (VC:L only, no integrity or availability impact) suggest this requires specific application knowledge or repeated attempts. Public exploit availability increases theoretical risk slightly but does not change the fundamental assessment: this is a foundational access or privilege escalation precursor (weak credentials enable subsequent attacks), not a critical standalone vulnerability. The lack of vendor response lowers confidence in patch availability but does not inflate the immediate risk. Real-world priority should be low unless the affected organization uses NovoSGA as an authentication gateway for higher-value systems.

An attacker with network access to the NovoSGA user creation endpoint (/novosga.users/new) submits an HTTP request with a Senha parameter set to a very short or empty value, bypassing client-side or inadequate server-side password validation. The application accepts the weak password and creates a user account. The attacker then uses dictionary or brute-force tools to compromise the newly created account, gaining initial access to NovoSGA and potentially pivoting to downstream systems that trust NovoSGA authentication.