CVE-2025-55371
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In jshERP v3.5, the component PersonController.java has incorrect access control, allowing unauthorized attackers to obtain all handler information by executing the getAllList method.
Risk Assessment
The risk involves leakage of sensitive personal data, which may violate user privacy and data protection regulations, and enable further social engineering attacks.
Recommendation
Immediately implement authentication and authorization mechanisms for the getAllList method in PersonController.java, and conduct a security audit of the entire jshERP system.
Original NVD description (English source)
Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing the getAllList method.