CVE-2025-34160 (CNNVD-202508-3162)
中文标题:
AiShu AnyShare 安全漏洞
英文标题:
AnyShare ServiceAgent API Unauthenticated RCE
漏洞描述
中文描述:
AiShu AnyShare是中国爱数（AiShu）公司的一款企业内容管理平台。 AiShu AnyShare存在安全漏洞，该漏洞源于ServiceAgent API未经验证且未清理输入，可能导致远程代码执行。
英文描述:
AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/start_service accepts user-supplied input via POST and fails to sanitize command-like payloads. An attacker can inject shell syntax that is interpreted by the backend, enabling arbitrary command execution. The vulnerability is presumed to affect builds released prior to August 2025 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 UTC.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Shanghai Aishu Information Technology Co., Ltd. | AnyShare | - | ≤ pre-August 2025 builds | - |
cpe:2.3:a:shanghai_aishu_information_technology_co.,_ltd.:anyshare:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-34160 |
2025-11-11 15:23:17 | 2025-11-11 07:40:25 |
| NVD | nvd_CVE-2025-34160 |
2025-11-11 15:01:00 | 2025-11-11 07:48:15 |
| CNNVD | cnnvd_CNNVD-202508-3162 |
2025-11-11 15:12:55 | 2025-11-11 08:00:07 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-3162
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']