PT-2025-12397 · Unknown · Openslides

Published 2025-03-21 · Updated 2025-03-23 · CVE-2025-30345

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenSlides versions prior to 4.2.5

Description An issue was discovered in OpenSlides where users can specify the name of the chat when creating new chats via the chat group.create action. Some HTML elements are filtered, but others are not, and HTML entities are not properly encoded when deleting chats or messages. This potentially allows attackers to interfere with the layout of the rendered website.

Recommendations For versions prior to 4.2.5, update to version 4.2.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTML elements in chat names to minimize the risk of exploitation. Avoid using the chat group.create action with untrusted input until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2025-30345

Affected Products

Openslides

References · 9

• 🔥 https://x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30345 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30345 · Vendor Advisory
• https://twitter.com/SystemTek_UK/status/1903817163057541306 · Twitter Post
• https://t.me/cvedetector/20787 · Telegram Post
• https://t.me/cvetracker/19594 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1903090953742643398 · Twitter Post
• https://t.me/cvenotify/115618 · Telegram Post
• https://twitter.com/CVEnew/status/1902968829053227473 · Twitter Post