CVE-2025-66838

{
  "id": "CVE-2025-66838",
  "sourceIdentifier": "[email protected]",
  "published": "2026-01-07T16:15:51.027",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unrestricted rate. An attacker can exploit this behavior to rapidly upload a large volume of files, potentially leading to resource exhaustion such as disk space depletion, increased server load, or degraded performance"
    },
    {
      "lang": "es",
      "value": "En Aris v10.0.23.0.3587512 y versiones anteriores, la funcionalidad de carga de archivos no aplica ninguna limitación de velocidad (rate limiting) ni estrangulamiento (throttling), permitiendo a los usuarios cargar archivos a una velocidad sin restricciones. Un atacante puede explotar este comportamiento para cargar rápidamente un gran volumen de archivos, lo que podría llevar al agotamiento de recursos como el agotamiento del espacio en disco, el aumento de la carga del servidor o la degradación del rendimiento."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-01-07T16:21:54.056506Z",
          "id": "CVE-2025-66838",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:softwareag:aris:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "10.0.23.0.3587512",
              "matchCriteriaId": "073C0921-42E0-48C3-9DDC-65C5D5B34471"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/saykino/CVE-2025-66838/",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.softwareag.com/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}