CVE-2025-9004 is a Low severity (CVSS 3.7) weakness in mtons mblog up to version 3.5.0. The /settings/password page does not limit repeated attempts. No fixed version is confirmed, so add rate limiting in front of the app and use strong passwords.
What's affected
The record lists mtons mblog up to 3.5.0. The issue affects processing of the file /settings/password, and the manipulation leads to improper restriction of excessive authentication attempts. The record says the attack can be started remotely, that complexity is rather high and exploitation is known to be difficult, and that the exploit has been disclosed publicly. The score is 3.7 with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, which shows limited confidentiality impact only.
The reporter issue on Gitee says the endpoint has no rate limiting and no CAPTCHA, so a password can be guessed by repeated tries. The issue is in Backlog status with no comments, no linked fix and no maintainer response, so we could not confirm a fixed version. Check the project's releases for anything newer than 3.5.0.
How to check if you're exposed
- Find your mblog version in the project's pom or build file, or in the admin page, and confirm whether it is 3.5.0 or earlier.
- Check whether the password settings page is reachable from the internet.
- Look at your reverse proxy or web application firewall for any rate limit on that path.
- Search access logs for bursts of requests to /settings/password from one address.
What to do now
- Add rate limiting and lockout for that path at the reverse proxy or firewall, since the application does not appear to do it.
- Require strong, unique passwords for every blog account and check them against a list of known leaked passwords.
- Turn on multi factor authentication in front of the app if your proxy or identity layer supports it.
- Watch the project for a release that adds throttling or a CAPTCHA, and read its notes before you upgrade.
- Alert on repeated failed attempts so a guessing run is noticed.
Why it matters
The weakness classes are CWE-307 (improper restriction of excessive authentication attempts) and CWE-799 (improper control of interaction frequency). When a form accepts unlimited tries, a weak password stops being a small risk and becomes a matter of time. The score is low because exploitation is difficult and the impact is limited, and that is a fair reading.
It is not a CISA Known Exploited Vulnerability according to the record. A Low rating is not a reason to ignore it on a site where accounts reuse passwords, but it is a reason to fix it with cheap controls first.
Quick check
Is CVE-2025-9004 serious?
The record rates it Low at 3.7. Exploitation is described as difficult. Limit attempts and use strong passwords, and the risk drops further.
Is there a fixed mblog version?
We could not confirm one. The reporter issue shows no fix. Check the project releases.
Sources
Last reviewed: 18 October 2026.
