CVE-2025-3322 - Vulnerability Details - OpenCVE

An improper neutralization of inputs used in expression
language allows remote code execution with the highest privileges on the
server.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00494.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

No data.

Fixes

Solution

Field Service Information FSI 14-25 “OnlineSuite AP3.0 - Security Fix” provides a patch to these issues.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.bbraun.com/productsecurity

History

Fri, 06 Jun 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 06 Jun 2025 08:30:00 +0000

Type	Values Removed	Values Added
Description		An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server.
Title		Improper Neutralization of Special Elements in OnlineSuite
Weaknesses		CWE-917
References		https://www.bbraun.com/productsecurity
Metrics		cvssV4_0 `{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: B.Braun

Published: 2025-06-06T08:13:12.028Z

Updated: 2025-06-06T17:29:30.972Z

Reserved: 2025-04-05T19:02:30.304Z

Link: CVE-2025-3322

Vulnrichment

Updated: 2025-06-06T17:26:44.611Z

NVD

Status : Awaiting Analysis

Published: 2025-06-06T09:15:23.003

Modified: 2025-06-06T14:07:28.330

Link: CVE-2025-3322

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3322", "assignerOrgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d", "state": "PUBLISHED", "assignerShortName": "B.Braun", "dateReserved": "2025-04-05T19:02:30.304Z", "datePublished": "2025-06-06T08:13:12.028Z", "dateUpdated": "2025-06-06T17:29:30.972Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OnlineSuite", "vendor": "B. Braun Melsungen AG", "versions": [{"status": "affected", "version": "3.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Fabian Weber (CODE WHITE GmbH)"}, {"lang": "en", "type": "reporter", "value": "Dr. Florian Hauser (CODE WHITE GmbH)"}], "datePublic": "2025-06-06T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An improper neutralization of inputs used in expression\nlanguage allows remote code execution with the highest privileges on the\nserver.</p>"}], "value": "An improper neutralization of inputs used in expression\nlanguage allows remote code execution with the highest privileges on the\nserver."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-917", "description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d", "shortName": "B.Braun", "dateUpdated": "2025-06-06T08:13:12.028Z"}, "references": [{"url": "https://www.bbraun.com/productsecurity"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Field Service Information FSI 14-25 \u201cOnlineSuite AP3.0 - Security Fix\u201d provides a patch to these issues.\n\n<br>"}], "value": "Field Service Information FSI 14-25 \u201cOnlineSuite AP3.0 - Security Fix\u201d provides a patch to these issues."}], "source": {"discovery": "UNKNOWN"}, "title": "Improper Neutralization of Special Elements in OnlineSuite", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-06T17:19:28.552605Z", "id": "CVE-2025-3322", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-06T17:29:30.972Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3322", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-06T17:19:28.552605Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-06T17:26:44.611Z"}}], "cna": {"title": "Improper Neutralization of Special Elements in OnlineSuite", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Fabian Weber (CODE WHITE GmbH)"}, {"lang": "en", "type": "reporter", "value": "Dr. Florian Hauser (CODE WHITE GmbH)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "B. Braun Melsungen AG", "product": "OnlineSuite", "versions": [{"status": "affected", "version": "3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Field Service Information FSI 14-25 \u201cOnlineSuite AP3.0 - Security Fix\u201d provides a patch to these issues.", "supportingMedia": [{"type": "text/html", "value": "Field Service Information FSI 14-25 \u201cOnlineSuite AP3.0 - Security Fix\u201d provides a patch to these issues.\n\n<br>", "base64": false}]}], "datePublic": "2025-06-06T07:00:00.000Z", "references": [{"url": "https://www.bbraun.com/productsecurity"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An improper neutralization of inputs used in expression\nlanguage allows remote code execution with the highest privileges on the\nserver.", "supportingMedia": [{"type": "text/html", "value": "<p>An improper neutralization of inputs used in expression\nlanguage allows remote code execution with the highest privileges on the\nserver.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-917", "description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')"}]}], "providerMetadata": {"orgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d", "shortName": "B.Braun", "dateUpdated": "2025-06-06T08:13:12.028Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3322", "state": "PUBLISHED", "dateUpdated": "2025-06-06T17:29:30.972Z", "dateReserved": "2025-04-05T19:02:30.304Z", "assignerOrgId": "653264ec-f98b-4e8f-b8b4-540a01b7657d", "datePublished": "2025-06-06T08:13:12.028Z", "assignerShortName": "B.Braun"}, "dataVersion": "5.1"}