{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-13209",
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "state": "PUBLISHED",
        "assignerShortName": "VulDB",
        "dateReserved": "2025-11-14T19:00:50.250Z",
        "datePublished": "2025-11-15T18:32:06.823Z",
        "dateUpdated": "2025-11-17T15:58:53.721Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
                "shortName": "VulDB",
                "dateUpdated": "2025-11-15T18:32:06.823Z"
            },
            "title": "bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "type": "CWE",
                            "cweId": "CWE-611",
                            "lang": "en",
                            "description": "XML External Entity Reference"
                        }
                    ]
                },
                {
                    "descriptions": [
                        {
                            "type": "CWE",
                            "cweId": "CWE-610",
                            "lang": "en",
                            "description": "Externally Controlled Reference"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "bestfeng",
                    "product": "oa_git_free",
                    "versions": [
                        {
                            "version": "9.0",
                            "status": "affected"
                        },
                        {
                            "version": "9.1",
                            "status": "affected"
                        },
                        {
                            "version": "9.2",
                            "status": "affected"
                        },
                        {
                            "version": "9.3",
                            "status": "affected"
                        },
                        {
                            "version": "9.4",
                            "status": "affected"
                        },
                        {
                            "version": "9.5",
                            "status": "affected"
                        }
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\\server\\c-flow\\src\\main\\java\\com\\cloudweb\\oa\\controller\\WorkflowPredefineController.java. This manipulation of the argument writeProp causes xml external entity reference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited."
                },
                {
                    "lang": "de",
                    "value": "Eine Schwachstelle wurde in bestfeng oa_git_free up to 9.5 gefunden. Hierbei geht es um die Funktion updateWriteBack der Datei yimioa-oa9.5\\server\\c-flow\\src\\main\\java\\com\\cloudweb\\oa\\controller\\WorkflowPredefineController.java. Dank der Manipulation des Arguments writeProp mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit ist öffentlich verfügbar und könnte genutzt werden."
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "version": "4.0",
                        "baseScore": 5.3,
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
                        "baseSeverity": "MEDIUM"
                    }
                },
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "baseScore": 6.3,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
                        "baseSeverity": "MEDIUM"
                    }
                },
                {
                    "cvssV3_0": {
                        "version": "3.0",
                        "baseScore": 6.3,
                        "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
                        "baseSeverity": "MEDIUM"
                    }
                },
                {
                    "cvssV2_0": {
                        "version": "2.0",
                        "baseScore": 6.5,
                        "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"
                    }
                }
            ],
            "timeline": [
                {
                    "time": "2025-11-14T00:00:00.000Z",
                    "lang": "en",
                    "value": "Advisory disclosed"
                },
                {
                    "time": "2025-11-14T01:00:00.000Z",
                    "lang": "en",
                    "value": "VulDB entry created"
                },
                {
                    "time": "2025-11-14T20:06:01.000Z",
                    "lang": "en",
                    "value": "VulDB entry last update"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "youran (VulDB User)",
                    "type": "reporter"
                }
            ],
            "references": [
                {
                    "url": "https://vuldb.com/?id.332528",
                    "name": "VDB-332528 | bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference",
                    "tags": [
                        "vdb-entry",
                        "technical-description"
                    ]
                },
                {
                    "url": "https://vuldb.com/?ctiid.332528",
                    "name": "VDB-332528 | CTI Indicators (IOB, IOC, IOA)",
                    "tags": [
                        "signature",
                        "permissions-required"
                    ]
                },
                {
                    "url": "https://vuldb.com/?submit.685626",
                    "name": "Submit #685626 | https://gitee.com/bestfeng/oa_git_free oa_git_free 8.0 XML external entity injection",
                    "tags": [
                        "third-party-advisory"
                    ]
                },
                {
                    "url": "https://github.com/bkglfpp/CVE-md/blob/main/%E4%BA%91%E7%BD%91%E5%8D%8F%E5%90%8C%E5%8A%9E%E5%85%AC%E7%B3%BB%E7%BB%9F/XXE.md",
                    "tags": [
                        "exploit"
                    ]
                }
            ]
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2025-11-17T15:58:27.666432Z",
                                "id": "CVE-2025-13209",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2025-11-17T15:58:53.721Z"
                }
            }
        ]
    }
}