CVE-2025-41351 — Weak encryption on Funambol's cloud server

CVE-2025-41351

Weak encryption on Funambol's cloud server PUBLISHED

Description (CNA)

Vulnerability that allows a Padding Oracle Attack to be performed on the Funambol v30.0.0.20 cloud server. The thumbnail display URL allows an attacker to decrypt and encrypt the parameters used by the application to generate ‘self-signed’ access URLs.

Affected (CNA)

Vendor / product	Versions
Funambol / Cloud Server	affected 30.0.0.20

CWE

CWE-649

References

https://www.incibe.es/en/incibe-cert/notices/aviso/weak-encryption-funambols-cloud-server

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.