CVE-2025-13282highCWE-352CWE-36

CVE-2025-13282: fallo de gravedad alta en Chunghwa Telecom TenderDocTransfer

Chunghwa Telecom｜TenderDocTransfer - Arbitrary File Delete

Publicada el

Seguir esta CVE+ Monitorear TenderDocTransfer

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7epss 0.3%
TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Chunghwa Telecom · TenderDocTransfer
CVEs relacionadas — Chunghwa Telecom TenderDocTransfer

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-12641CRITICALChunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCEEPSS 1.4%CVE-2024-12642HIGHChunghwa Telecom TenderDocTransfer - Arbitrary File WriteEPSS 0.4%CVE-2025-13283HIGHChunghwa Telecom｜TenderDocTransfer - Arbitrary File Copy and PasteEPSS 0.3%