CVE-2025-6050

Katalog CVE

CVSS 4.8 · Medium EPSS 0,32%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada jupo mezzanine. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.

Rincian

Terbit di NVD

17 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8 patch
• https://advisory.checkmarx.net/advisory/CVE-2025-6050/ exploit · advisory pihak ketiga
• https://github.com/stephenmcd/mezzanine/discussions/2080 issue tracking