CVE-2025-34337

eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes an encryption oracle that allows attackers to generate valid ciphertext for chosen values. The image upload endpoints /utl/wed/insertImage.do and /utl/wed/insertImageCk.do encrypt server-side paths, filenames, and MIME types and embed them directly into a download URL that is returned to the client. Because these same encrypted parameters are trusted by other endpoints, such as /utl/web/imageSrc.do and /cmm/fms/getImage.do, an unauthenticated attacker can abuse the upload functionality to obtain encrypted representations of attacker-chosen identifiers and then replay those ciphertext values to file-serving APIs. This design failure allows an attacker to bypass access controls that rely solely on the secrecy of encrypted parameters and retrieve arbitrary stored files that are otherwise expected to require an existing session or specific authorization context. KISA/KrCERT has identified this unpatched vulnerability as "KVE-2023-5281."

• CWE-345

• https://github.com/eGovFramework/egovframe-common-components
• https://pierrekim.github.io/advisories/2025-egovframe.txt
• https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html
• https://www.egovframe.go.kr/eng/sub.do?menuNo=2
• https://www.vulncheck.com/advisories/egovframework-unauthenticated-encryption-oracle-via-web-editor-image-upload-endpoints

Published

Nov 19, 2025

Last Modified

Jul 14, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34331AudioCodes Fax Server and Auto-Attendant IVR appliances vers…7.5
• CVE-2025-34332AudioCodes Fax Server and Auto-Attendant IVR appliances vers…7.8
• CVE-2025-34333AudioCodes Fax Server and Auto-Attendant IVR appliances vers…7.8
• CVE-2025-34334AudioCodes Fax Server and Auto-Attendant IVR appliances vers…8.8
• CVE-2025-34335AudioCodes Fax Server and Auto-Attendant IVR appliances vers…8.8
• CVE-2025-34336eGovFramework/egovframe-common-components versions up to and…6.9
• CVE-2025-34338Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-34339Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-3434The SMTP for Amazon SES – YaySMTP plugin for WordPress is vu…7.2
• CVE-2025-34340Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-34341Rejected reason: This CVE ID was rejected because it was res…
• CVE-2025-34342Rejected reason: This CVE ID was rejected because it was res…