Deserialization in Opplus Springboot-Admin
CVE-2025-3413
A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerability is the function code of the file SysGeneratorController.java. The manipulation of the argument Tables leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.005 (40.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Opplus Springboot-admin — versions a2d5310f44fd46780a8686456cf2f9001ab8f024
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (exploit, Broken Link)
Frequently asked questions
- What is CVE-2025-3413?
- CVE-2025-3413 is a medium-severity vulnerability in Opplus Springboot-Admin, classified under Improper Input Validation. CVSS score: 6.3/10. Published 2025-04-08.
- How severe is CVE-2025-3413?
- Medium severity. CVSS v3 base score is 6.3 out of 10.