CVE-2025-63498

Katalog CVE

CVSS 6.1 · Medium EPSS 0,29%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada alinto sogo, debian linux. Skor CVSS 3.1 6.1 (Medium) menurut CISA ADP.

Deskripsi (NVD)

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.

Rincian

Terbit di NVD

24 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Alinto/sogo/commit/9e20190fad1a437f7e1307f0adcfe19a8d45184c patch
• https://github.com/xryptoh/CVE-2025-63498 exploit · advisory pihak ketiga
• https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 release notes
• https://lists.debian.org/debian-lts-announce/2025/11/msg00029.html mailing list