PT-2025-25601 · Unknown · Group-Office

Kh0Kamoni · Publicado 2025-06-17 · Atualizado 2025-06-17 · CVE-2025-48993

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.123 and 25.0.27

Description The issue is related to a reflected cross-site scripting (XSS) attack. A malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input.

Recommendations For versions prior to 6.8.123, update to version 6.8.123 or later. For versions prior to 25.0.27, update to version 25.0.27 or later. As a temporary workaround, consider restricting access to the Look and Feel formatting fields until a patch is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-48993

GHSA-XV2X-V374-92GV

Produtos afetados

Group-Office

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48993.json · Exploit
• https://github.com/Intermesh/groupoffice/commit/a9031884f6a6fbd0f08a8b7790514b5bc0937c11 · Correção
• https://github.com/Intermesh/groupoffice/commit/1e2a2450f204174f87a93217838d74718996dcdd · Correção
• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-xv2x-v374-92gv · Nota
• https://twitter.com/VulmonFeeds/status/1934802335890342020 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-48993 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-48993 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1934780726395769314 · Publicação no Twitter