PT-2025-11281 · Leica · Aperio Eslide Manager Application

Published 2025-03-14 · Updated 2025-03-14 · CVE-2025-1888

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Aperio Eslide Manager Application (affected versions not specified)

Description: The issue concerns reflected cross-site scripting (XSS) within the Leica Web Viewer component of the Aperio Eslide Manager Application. An authenticated user can inject malicious JavaScript into the memo field, which is executed when a user hovers over the field to view the memo associated with a slide, utilizing a Microsoft Tool Tip. This allows for the execution of malicious JavaScript code.

Recommendations: For the Aperio Eslide Manager Application, consider disabling the hover-over action for the memo field until a patch is available to prevent the execution of malicious JavaScript code. Restrict access to the Leica Web Viewer component to minimize the risk of exploitation. Avoid using the memo field in the Leica Web Viewer until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-1888

Affected Products

Aperio Eslide Manager Application

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-1888 · Security Note
• https://t.me/cvedetector/20317 · Telegram Post
• https://twitter.com/CVEnew/status/1900587576366387607 · Twitter Post
• https://t.me/cvetracker/19134 · Telegram Post
• https://blog.blacklanternsecurity.com/p/cve-2025-1888reflected-xss-in-aperio · Note