CVE-2025-45607: 
Java vulnerability analysis and mitigation

An authentication bypass vulnerability was discovered in itranswarp version 2.19, identified as CVE-2025-45607. The vulnerability was disclosed on May 5, 2025, affecting the /manage/ component of the application. This security flaw allows attackers to bypass authentication mechanisms through specially crafted requests (MITRE CVE, NVD).

The vulnerability exists in the GlobalFilter#doFilter component where the jakarta.servlet.http.HttpServletRequest#getRequestURI method is used to obtain the resource being accessed by the current user. The security flaw stems from insufficient special character filtering in the URI validation process. The authorization check only verifies if the URI starts with /manage/, which can be bypassed using path manipulation techniques such as /manage;/. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (GitHub Issue, NVD).

The vulnerability allows unauthenticated attackers to access the /manage/ administrative component of the application, potentially leading to complete system compromise. The high CVSS score of 9.8 indicates critical severity with potential for high impacts on confidentiality, integrity, and availability of the system (NVD).