PT-2025-52221 · Unknown · Asset List

Stefano Libero · Publicado 2025-12-18 · Atualizado 2025-12-18 · CVE-2025-40893

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Asset List (affected versions not specified)

Description A Stored HTML Injection issue exists in the Asset List functionality because of inadequate validation of network traffic data. An unauthenticated attacker can send crafted network packets to inject HTML tags into asset attributes. When a victim views the affected assets in the Asset List and similar functions, the injected HTML renders in their browser, potentially enabling phishing and open redirect attacks. Existing input validation and Content Security Policy configurations prevent full Cross-Site Scripting (XSS) exploitation and direct information disclosure. The vulnerability involves improper validation of network traffic data, allowing for the injection of HTML tags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-40893

Produtos afetados

Asset List

Referências · 6

• https://twitter.com/CVEnew/status/2001728071536443522 · Publicação no Twitter
• https://t.me/cveNotify/146194 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-40893 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-40893 · Aviso do Fabricante
• https://t.me/CVEtracker/40150 · Publicação no Telegram
• https://security.nozominetworks.com/NN-2025:14-01 · Aviso do Fabricante