Threats affecting pkg:github/sunbird-ed/SunbirdEd-portal

An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive information

An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.

CVE-2025-70028 is a high-severity path traversal vulnerability (CWE-22) found in Sunbird-Ed SunbirdEd-portal version 1.13.4. This vulnerability allows an unauthenticated remote attacker to cause a denial of service by exploiting improper limitation of pathnames, potentially disrupting availability. There is no known exploit in the wild yet, and no patch has been published. The vulnerability does not impact confidentiality or integrity but can severely affect system availability. Exploitation requires no privileges or user interaction and can be performed remotely over the network. Organizations using SunbirdEd-portal should prioritize monitoring and mitigating this issue to prevent service disruptions. Countries with significant deployments of SunbirdEd-portal, especially in education sectors, are at higher risk. Immediate mitigation steps include restricting access, applying virtual patching, and monitoring for suspicious path traversal attempts until an official patch is released.

CVE-2025-70031 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Sunbird-Ed portal version 1.13.4. This vulnerability allows remote attackers to trick authenticated users into executing unwanted actions without their consent, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. Exploitation requires user interaction but no privileges or authentication are needed by the attacker. Although no known exploits are currently in the wild and no patches have been published, the vulnerability's CVSS score of 8.8 indicates a critical risk. Organizations using Sunbird-Ed portal should prioritize mitigation to prevent unauthorized state-changing requests. The threat is particularly relevant to countries with significant deployments of Sunbird-Ed, especially in education sectors. Immediate defensive measures include implementing CSRF tokens, validating request origins, and educating users about phishing risks.

CVE-2025-70033 is a medium severity vulnerability in Sunbird-Ed SunbirdEd-portal v1.13.4 related to improper neutralization of input during web page generation (CWE-79), commonly known as a Cross-Site Scripting (XSS) issue. The vulnerability allows remote attackers to inject malicious scripts via crafted input, requiring user interaction but no authentication. Exploitation can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There are no known exploits in the wild, and no official patches have been released yet. Organizations using this version of SunbirdEd-portal should prioritize input validation and output encoding to mitigate risks. Countries with significant adoption of SunbirdEd or similar educational platforms, especially those with large deployments in education sectors, are at higher risk. The vulnerability has a CVSS score of 5.4, indicating a medium severity level.