CVE-2025-55367

MediumCVSS 5.3

Published: 21/08/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

In jshERP v3.5, the SupplierController.java component has an incorrect access control vulnerability, allowing unauthorized attackers to arbitrarily modify supplier status on any account.

Risk Assessment

The risk involves potential compromise of supplier data integrity by unauthorized users, which can disrupt business processes and erode trust in the system.

Recommendation

Immediately update jshERP to the latest version and implement proper authorization mechanisms for all supplier management endpoints.

Original NVD description (English source)

Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.