CVE-2025-1774

Incorrect string encoding vulnerability in NASK - PIB BotSense allows injection of an additional field separator character or value in the content of some fields of the generated event. A field with additional field separator characters or values can be included in the "extraData" field.This issue affects BotSense in versions before 2.8.0.

Score

CVSS 4.0 6.3 Medium

Status

Deferred - cvd@cert.pl

Published

2025-03-17

Last modified

2025-03-17

Weaknesses

CWE-142, CWE-143

Affected products

• Botsense (Nask - Pib)

References

• https://cert.pl/en/posts/2025/03/CVE-2025-1774/
• https://cert.pl/posts/2025/03/CVE-2025-1774/
• https://nask.pl/instytut/dla-biznesu/botsense/