SohuTV CacheCloud CVE-2025-15201
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege attacker causes reflected XSS via crafted link clicked by victim, affecting integrity only, unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in SohuTV CacheCloud up to 3.2.0. The impacted element is the function redirectNoPower of the file src/main/java/com/sohu/cache/web/controller/WebResourceController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Cross-site scripting in SohuTV CacheCloud up to 3.2.0 allows remote attackers to inject arbitrary web scripts or HTML via the redirectNoPower function in WebResourceController.java. The flaw requires a low-privileged authenticated user to interact with a crafted link. Public exploit code exists, but no active exploitation has been confirmed.
Technical ContextAI
The vulnerability stems from a reflected cross-site scripting flaw (CWE-79) in the Java-based SohuTV CacheCloud web application, a Redis cache management platform. The affected component is the redirectNoPower method of the WebResourceController, which likely fails to properly encode user-supplied input before reflecting it in HTTP responses, enabling script injection. CPE data identifies all versions up to 3.2.0 as affected.
RemediationAI
No vendor-released patch is yet available; the maintainers have not responded to the issue report. As a compensating control, restrict access to the redirectNoPower endpoint if it is not required, or deploy a web application firewall (WAF) rule to filter script payloads in request parameters. Input sanitization and output encoding should be implemented by the development team. Monitor the GitHub issue for updates: https://github.com/sohutv/cachecloud/issues/373.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today