CVE-2025-43854

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/langgenius/dify/pull/18516	Issue Tracking Patch
https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p	Vendor Advisory
https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:*

History

12 May 2025, 19:37

Type	Values Removed	Values Added
References	~~() https://github.com/langgenius/dify/pull/18516 -~~	() https://github.com/langgenius/dify/pull/18516 - Issue Tracking, Patch
References	~~() https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p -~~	() https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1
CPE		cpe:2.3:a:langgenius:dify::::::node.js::*
First Time		Langgenius Langgenius dify

29 Apr 2025, 13:52

Type	Values Removed	Values Added
Summary		(es) DIFY es una plataforma de desarrollo de aplicaciones LLM de código abierto. Antes de la versión 1.3.0, se detectó una vulnerabilidad de clickjacking en la configuración predeterminada de la aplicación DIFY, que permitía a actores maliciosos engañar a los usuarios para que hicieran clic en elementos de la página web sin su conocimiento ni consentimiento. Esto puede provocar acciones no autorizadas, lo que podría comprometer la seguridad y la privacidad de los usuarios. Este problema se ha corregido en la versión 1.3.0.

28 Apr 2025, 18:15

Type	Values Removed	Values Added
References	~~() https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p -~~	() https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p -

28 Apr 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-28 16:15

Updated : 2025-05-12 19:37

NVD link : CVE-2025-43854

Mitre link : CVE-2025-43854

CVE.ORG link : CVE-2025-43854

JSON object : View

Products Affected

langgenius

dify

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-43854", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-28T16:15:33.043", "references": [{"url": "https://github.com/langgenius/dify/pull/18516", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to unauthorized actions being performed, potentially compromising the security and privacy of users. This issue has been fixed in version 1.3.0."}, {"lang": "es", "value": "DIFY es una plataforma de desarrollo de aplicaciones LLM de c\u00f3digo abierto. Antes de la versi\u00f3n 1.3.0, se detect\u00f3 una vulnerabilidad de clickjacking en la configuraci\u00f3n predeterminada de la aplicaci\u00f3n DIFY, que permit\u00eda a actores maliciosos enga\u00f1ar a los usuarios para que hicieran clic en elementos de la p\u00e1gina web sin su conocimiento ni consentimiento. Esto puede provocar acciones no autorizadas, lo que podr\u00eda comprometer la seguridad y la privacidad de los usuarios. Este problema se ha corregido en la versi\u00f3n 1.3.0."}], "lastModified": "2025-05-12T19:37:01.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "83A72F27-96F5-4A82-AE11-E2950897E18A", "versionEndIncluding": "0.6.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}

6.1 /10