CVE-2025-43854

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/langgenius/dify/pull/18516
https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p
https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p

Configurations

No configuration.

History

29 Apr 2025, 13:52

Type	Values Removed	Values Added
Summary		(es) DIFY es una plataforma de desarrollo de aplicaciones LLM de código abierto. Antes de la versión 1.3.0, se detectó una vulnerabilidad de clickjacking en la configuración predeterminada de la aplicación DIFY, que permitía a actores maliciosos engañar a los usuarios para que hicieran clic en elementos de la página web sin su conocimiento ni consentimiento. Esto puede provocar acciones no autorizadas, lo que podría comprometer la seguridad y la privacidad de los usuarios. Este problema se ha corregido en la versión 1.3.0.

28 Apr 2025, 18:15

Type	Values Removed	Values Added
References	~~() https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p -~~	() https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p -

28 Apr 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-28 16:15

Updated : 2025-04-29 13:52

NVD link : CVE-2025-43854

Mitre link : CVE-2025-43854

CVE.ORG link : CVE-2025-43854

JSON object : View

Products Affected

No product.

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-43854", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-28T16:15:33.043", "references": [{"url": "https://github.com/langgenius/dify/pull/18516", "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p", "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0."}, {"lang": "es", "value": "DIFY es una plataforma de desarrollo de aplicaciones LLM de c\u00f3digo abierto. Antes de la versi\u00f3n 1.3.0, se detect\u00f3 una vulnerabilidad de clickjacking en la configuraci\u00f3n predeterminada de la aplicaci\u00f3n DIFY, que permit\u00eda a actores maliciosos enga\u00f1ar a los usuarios para que hicieran clic en elementos de la p\u00e1gina web sin su conocimiento ni consentimiento. Esto puede provocar acciones no autorizadas, lo que podr\u00eda comprometer la seguridad y la privacidad de los usuarios. Este problema se ha corregido en la versi\u00f3n 1.3.0."}], "lastModified": "2025-04-29T13:52:10.697", "sourceIdentifier": "security-advisories@github.com"}