CVE-2025-35056
Last modified
CVE-2025-35056 is a medium-severity vulnerability rated 5/10 on the CVSS scale. Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to the privileges of NIX, typically 'NT AUTHORITY\NetworkService', and the ability of StreamStampImage to process the file. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to the privileges of NIX, typically 'NT AUTHORITY\NetworkService', and the ability of StreamStampImage to process the file. The encrypted file path can be generated using the shared, hard-coded secret key described in CVE-2025-35052. This vulnerability cannot be exploited as an 'anonymous' user as described in CVE-2025-35062.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Newforma | Project Center | < 2024.1 |
References
- https://www.cve.org/CVERecord?id=CVE-2025-35056Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-35062Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-35056?
How severe is CVE-2025-35056?
How do I fix CVE-2025-35056?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-35050Newforma Info Exchange (NIX) accepts serialized .NET data vi…9.8
- CVE-2025-35051Newforma Project Center Server (NPCS) accepts serialized .NE…9.8
- CVE-2025-35052Newforma Info Exchange (NIX) uses a hard-coded key to encryp…6.3
- CVE-2025-35053Newforma Info Exchange (NIX) accepts requests to '/UserWeb/C…6.4
- CVE-2025-35054Newforma Info Exchange (NIX) stores credentials used to con…5.3
- CVE-2025-35055Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.…8.8
- CVE-2025-35057Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices…6
- CVE-2025-35058Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices…5.9
- CVE-2025-35059Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect…6.1
- CVE-2025-3506Files to be deployed with agents are accessible without auth…5.3
- CVE-2025-35060Newforma Info Exchange (NIX) provides a 'Send a File Transfe…5.4
- CVE-2025-35061Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrati…5.9
Are you affected by CVE-2025-35056?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST