PT-2025-11510 · Akamai · Akamai App & Api Protector

Published 2025-03-17 · Updated 2025-03-17 · CVE-2025-30143

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Akamai App & API Protector (with Akamai ASE) versions before 2024-12-10

Description The issue arises from improper consideration of JavaScript variable assignment to built-in functions and properties in Rule 3000216. This can potentially lead to exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

Recommendations For versions before 2024-12-10, update to a version that includes the fix for Rule 3000216, ensuring proper handling of JavaScript variable assignments to built-in functions and properties. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-30143

Affected Products

Akamai App & Api Protector

References · 6

• 🔥 https://github.com/geo-chen/Akamai/blob/main/README.md#cve-2025-30143---waf-bypass-in-akamai-ase-application-security-edge-due-to-obfuscated-payload-leading-to-reflected-xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30143 · Security Note
• https://t.me/cvedetector/20497 · Telegram Post
• https://techdocs.akamai.com/app-api-protector/changelog/dec-9-2024-waf-rule-updates · Note
• https://twitter.com/CVEnew/status/1901662337146540445 · Twitter Post
• https://t.me/cvetracker/19299 · Telegram Post