CVE-2025-11322: Weak Password Requirements in novosga Package User Creation Page
Summary
CVE-2025-11322: NovoSGA: Manipulation of User Creation Page can lead to weak password requirements. Affects novosga/novosga versions < 2.2.12. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Novosga is an open-source management system designed for healthcare environments, providing functionalities such as user management, appointment scheduling, and patient records. The package is widely used in various healthcare applications, but it has a vulnerability that affects its user creation process, specifically in the password requirements.
Vulnerability Detail
A flaw has been identified in the User Creation Page of the Novosga package, specifically in the handling of password fields. The vulnerability allows for weak password requirements due to improper validation of the 'Senha/Confirmação da senha' arguments. This can lead to users creating easily guessable passwords, increasing the risk of unauthorized access. The vulnerability can be exploited remotely, although the complexity of the attack is considered high. The vendor was notified but did not respond to the disclosure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional password strength validation on the client-side or server-side to enforce stronger password policies until the package is updated. For example, you can add a regex check to ensure passwords meet certain complexity requirements.
Conclusion
The vulnerability CVE-2025-11322 in the Novosga package poses a significant risk due to weak password requirements during user creation. It is crucial to update to the patched version to mitigate this risk. Additionally, implementing temporary workarounds can help enhance security until the update is applied.
See every vulnerability recorded for novosga/novosga →
FAQ
CVE-2025-11322 is a vulnerability in the Novosga package that allows for weak password requirements during user creation, potentially leading to unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is that users may create weak passwords, making it easier for attackers to gain unauthorized access to the system.
Yes, the vulnerability has been patched in version 2.2.13 of the Novosga package. It is recommended to update to this version or later.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file. It helps you stay informed about potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for novosga/novosga.
