CVE-2025-2833

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
VulDBCNA
5.3 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
VendorProductVersion
zhydoneblog
𝑥
≤ 2.3.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/zhangyd-c/OneBlog/issues/35
https://github.com/zhangyd-c/OneBlog/issues/35#issue-2914268214
https://vuldb.com/?ctiid.301470
https://vuldb.com/?id.301470
https://vuldb.com/?submit.521813
https://github.com/zhangyd-c/OneBlog/issues/35
https://github.com/zhangyd-c/OneBlog/issues/35#issue-2914268214