CVE-2025-62618

Katalog CVE

CVSS 8.0 · High EPSS 0,32%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada elog project elog. Skor CVSS 3.1 8.0 (High) menurut CNA.

Deskripsi (NVD)

ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or crack the password hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text.

Rincian

Terbit di NVD

31 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-836: Use of Password Hash Instead of Password for Authentication

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946 patch
• https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc patch
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2025-62618 advisory pihak ketiga
• https://elog.psi.ch/elog/download/RPMS/?C=M;O=D product