Security readout for executives and security teams
Plain-English summary
This flaw can let an unauthenticated attacker turn eGovFramework’s own image upload feature into a way to unlock protected file-download URLs. The business risk is unauthorized disclosure of stored files, especially where affected eGovFramework components are internet-facing.
Executive priority
Treat as a high-priority data exposure issue for any public or sensitive eGovFramework deployment. Prioritize discovery, access restriction, and vendor guidance review because the provided sources describe the issue as unpatched.
Technical view
eGovFramework/egovframe-common-components through 4.3.1 uses encrypted URL parameters for Web Editor image upload and file delivery workflows. Upload endpoints return encrypted attacker-influenced values that can be reused against trusted file-serving APIs, bypassing access controls that depend on parameter secrecy rather than server-side authorization.
Likely exposure
Applications using eGovFramework/egovframe-common-components up to and including 4.3.1 are the stated exposure. Risk is highest where Web Editor image upload and related image/file delivery routes are reachable without authentication.
Exploitation context
The bundle cites public technical and exploit-oriented writeups, but it does not cite CISA KEV listing or confirmed active exploitation. The CVSS 4.0 score is 8.7, with network access, low complexity, no privileges, and no user interaction required.
Researcher notes
The core weakness is authorization trust in encrypted client-returned parameters. Evidence supports CWE-345 and arbitrary stored-file retrieval under the described design. Affected version detail is limited to eGovFramework/egovframe-common-components up to 4.3.1; no fixed version is provided in the bundle.
Mitigation direction
- Check eGovFramework and KISA/KrCERT guidance for official patch or advisory status.
- Restrict unauthenticated access to Web Editor upload and file delivery routes.
- Disable unused Web Editor image upload functionality where business requirements allow.
- Enforce server-side authorization for every file retrieval request.
- Review logs for unusual unauthenticated access to affected upload and delivery paths.
Validation and detection
- Inventory applications using eGovFramework/egovframe-common-components through version 4.3.1.
- Confirm whether Web Editor image upload functionality is deployed and reachable.
- Review routing and access controls for image upload and file delivery endpoints.
- Verify file access decisions do not rely only on encrypted URL parameters.
- Check monitoring for suspicious unauthenticated requests to affected workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-345: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-34337 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.egovframe.go.kr/eng/sub.do?menuNo=2CVE reference, VulnCheck · product
- https://github.com/eGovFramework/egovframe-common-componentsCVE reference, VulnCheck · product
- https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.htmlCVE reference, VulnCheck · technical-description, exploit
- https://pierrekim.github.io/advisories/2025-egovframe.txtCVE reference, VulnCheck · technical-description, exploit
- https://www.vulncheck.com/advisories/egovframework-unauthenticated-encryption-oracle-via-web-editor-image-upload-endpointsCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.