CVE-2025-61987 — Japan Total System Co.,Ltd. / GroupSession Free edition

CVE-2025-61987

Japan Total System Co.,Ltd. / GroupSession Free edition PUBLISHED

Description (CNA)

GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. do not validate origins in WebSockets. If a user accesses a crafted page, Chat information sent to the user may be exposed.

Affected (CNA)

Vendor / product	Versions
Japan Total System Co.,Ltd. / GroupSession Free edition	affected prior to ver5.3.0
Japan Total System Co.,Ltd. / GroupSession byCloud	affected prior to ver5.3.3
Japan Total System Co.,Ltd. / GroupSession ZION	affected prior to ver5.3.2

CWE

CWE-1385

References

https://groupsession.jp/info/info-news/security20251208
https://jvn.jp/en/jp/JVN19940619/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.