CVE-2025-49590

Katalog CVE

CVSS 6.1 · Medium EPSS 0,33%

Kerentanan Incomplete Denylist to Cross-Site Scripting pada xwiki cryptpad. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.

Rincian

Terbit di NVD

18 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-692: Incomplete Denylist to Cross-Site Scripting

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj exploit · advisory vendor
• https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607 patch
• https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95 product