{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "lang": "en-US", "publisher": { "category": "coordinator", "contact_details": "https://www.cisa.gov/report", "issuing_authority": "CISA", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "title": "SicommNet multiple vulnerabilities", "tracking": { "current_release_date": "2025-04-23T00:00:00Z", "generator": { "engine": { "name": "VINCE-NT", "version": "1.8.0" } }, "id": "VA-25-104-01", "initial_release_date": "2025-04-15T13:49:55Z", "status": "final", "version": "2.0.0", "revision_history": [ { "number": "2.0.0", "summary": "Updated status for CVE-2025-22371", "date": "2025-04-23T00:00:00Z" }, { "number": "1.0.0", "summary": "Initial publication", "date": "2025-04-15T13:49:55Z" } ] }, "distribution": { "tlp": { "label": "WHITE" } }, "notes": [ { "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).", "title": "Legal Notice", "category": "legal_disclaimer" }, { "text": "United States", "title": "Countries and Areas Deployed", "category": "other" }, { "text": "Information Technology", "title": "Critical Infrastructure Sectors", "category": "other" }, { "text": "SicommNet BASEC is an online eProcurement solution used by governments and other entities. Multiple vulnerabilities have been found in BASEC. These vulnerabilities allow a remote, unauthenticated attacker to gain administrative privileges, read user passwords, and obtain credentials. The attacker could take complete control of BASEC and all of the user data stored in BASEC.", "title": "Risk Evaluation", "category": "summary" }, { "text": "Contact SicommNet. ", "title": "Recommended Practices", "category": "general" }, { "text": "United States", "title": "Company Headquarters Location", "category": "other" } ], "references": [ { "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-104-01.json", "summary": "Vulnerability Advisory VA-25-104-01 CSAF", "category": "self" } ] }, "product_tree": { "branches": [ { "category": "vendor", "name": "SicommNet", "branches": [ { "category": "product_name", "name": "BASEC", "branches": [ { "category": "product_version_range", "name": "<2025-04-16", "product": { "name": "SicommNet BASEC <2025-04-16", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "2025-04-16", "product": { "name": "SicommNet BASEC 2025-04-16", "product_id": "CSAFPID-0002" } }, { "category": "product_version", "name": "vers:all/*", "product": { "name": "SicommNet BASEC vers:all/*", "product_id": "CSAFPID-0003" } } ] } ] } ] }, "vulnerabilities": [ { "cve": "CVE-2025-22371", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "notes": [ { "category": "summary", "text": "An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the SicommNet BASEC (SaaS) login page allows an unauthenticated remote attacker to bypass authentication and execute arbitrary SQL commands. This issue was discovered on 2021-12-14 and fixed on 2025-04-16.", "title": "Description" }, { "category": "details", "title": "SSVC", "text": "SSVCv2/E:P/A:Y/T:T/2025-04-14T15:01:58Z/" } ], "title": "SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC", "product_status": { "known_affected": [ "CSAFPID-0001" ], "fixed": [ "CSAFPID-0002" ] }, "references": [ { "category": "external", "summary": "basec.sicomm.net", "url": "https://basec.sicomm.net/" }, { "category": "external", "summary": "csirt.divd.nl", "url": "https://csirt.divd.nl/DIVD-2025-00001" }, { "category": "external", "summary": "csirt.divd.nl", "url": "https://csirt.divd.nl/CVE-2025-22371" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22371" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed as of 2025-04-16.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22371", "product_ids": [ "CSAFPID-0001" ], "date": "2025-04-16T04:00:00Z" }, { "category": "vendor_fix", "details": "Fixed as of 2025-04-16.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22371", "product_ids": [ "CSAFPID-0002" ], "date": "2025-04-16T04:00:00Z" } ], "acknowledgments": [ { "names": [ "Frank Breedijk" ], "organization": "DIVD" }, { "names": [ "Jesse Meijer" ], "organization": "DIVD" } ], "release_date": "2025-04-14T00:00:00Z" }, { "cve": "CVE-2025-22372", "cwe": { "id": "CWE-522", "name": "Insufficiently Protected Credentials" }, "notes": [ { "category": "summary", "text": "An Insufficiently Protected Credentials vulnerability in SicommNet BASEC (SaaS) allows password recovery. Passwords are either stored in plain text or using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue was discovered on 2021-12-14.", "title": "Description" }, { "category": "details", "title": "SSVC", "text": "SSVCv2/E:P/A:N/T:T/2025-04-14T15:02:49Z/" } ], "title": "Insecure password storage in SicommNet BASEC", "product_status": { "known_affected": [ "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "basec.sicomm.net", "url": "https://basec.sicomm.net/login/" }, { "category": "external", "summary": "csirt.divd.nl", "url": "https://csirt.divd.nl/DIVD-2025-00001" }, { "category": "external", "summary": "csirt.divd.nl", "url": "https://csirt.divd.nl/CVE-2025-22372" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22372" } ], "scores": [ { "cvss_v3": { "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0003" ] } ], "remediations": [ { "category": "none_available", "details": "Contact SicommNet.", "product_ids": [ "CSAFPID-0003" ], "date": "2025-04-14T04:00:00Z" } ], "acknowledgments": [ { "names": [ "Jesse Meijer" ], "organization": "DIVD" }, { "names": [ "Frank Breedijk" ], "organization": "DIVD" } ], "release_date": "2025-04-14T00:00:00Z" }, { "cve": "CVE-2025-22373", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "summary", "text": "An Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC (SaaS) allows reflected XSS, XSS through HTTP query strings, rendering of arbitrary HTML, and alternation of CSS styles. This issue was discovered on 2021-12-14.", "title": "Description" }, { "category": "details", "title": "SSVC", "text": "SSVCv2/E:P/A:N/T:P/2025-04-14T15:03:52Z/" } ], "title": "XSS, HTML and Style injection on login page in SicommNet BASEC", "product_status": { "known_affected": [ "CSAFPID-0003" ] }, "references": [ { "category": "external", "summary": "basec.sicomm.net", "url": "https://basec.sicomm.net/login/" }, { "category": "external", "summary": "csirt.divd.nl", "url": "https://csirt.divd.nl/DIVD-2025-00001" }, { "category": "external", "summary": "csirt.divd.nl", "url": "https://csirt.divd.nl/CVE-2025-22373" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22373" } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0003" ] } ], "remediations": [ { "category": "none_available", "details": "Contact SicommNet.", "product_ids": [ "CSAFPID-0003" ], "date": "2025-04-14T04:00:00Z" } ], "acknowledgments": [ { "names": [ "Frank Breedijk" ], "organization": "DIVD" }, { "names": [ "Jesse Meijer" ], "organization": "DIVD" } ], "release_date": "2025-04-14T00:00:00Z" } ] }