CVE-2025-57644

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-57644
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, improper input validation allows for arbitrary file write and server-side request forgery (SSRF), enabling interaction with internal or external systems. Successful exploitation can lead to full server compromise, unauthorized access to sensitive data, and further network exploitation.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://medium.com/@anvarkh/cve-2025-57644-remote-code-execution-ssrf-in-accela-eedc6bc4adfb Third Party Advisory Mitigation
https://www.accela.com Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:accela:automation_platform:22.2.3.0.230103:*:*:*:*:*:*:*
History

No history.

Information

Published : 2025-09-19 16:15

Updated : 2025-10-17 14:21

NVD link : CVE-2025-57644

Mitre link : CVE-2025-57644

CVE.ORG link : CVE-2025-57644

JSON object : View

Products Affected

accela

  • automation_platform
CWE
CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-918

Server-Side Request Forgery (SSRF)