PT-2025-12776 · Asustor · Adm

Engin Aydoğan · Published 2025-03-25 · Updated 2025-07-18 · CVE-2025-7380

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: ADM versions 4.1.0 through 4.3.3.RH61 ADM version 5.0.0.RIN1 and earlier

Description: A stored Cross-Site Scripting (XSS) issue exists in the Access Control of ADM. The vulnerability allows an attacker to inject malicious scripts into the folder name field when creating a new shared folder. These scripts are not properly sanitized and will be executed when the folder name is displayed in the user interface. This allows attackers to execute arbitrary JavaScript in the context of another user's session, potentially accessing session cookies or other sensitive data.

Recommendations: Update ADM to a version later than 5.0.0.RIN1. Update ADM to a version later than 4.3.3.RH61.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-7380

Affected Products

Adm

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-7380 · Security Note
• https://asustor.com/security/security_advisory_detail?id=44 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1944659946571764149 · Twitter Post
• https://t.me/cvenotify/128800 · Telegram Post
• https://twitter.com/GothamJSharma/status/1904365804746862854 · Twitter Post
• https://t.me/cvetracker/27738 · Telegram Post
• https://reddit.com/r/asustor/comments/1m2uc4c/asustor_new_firmware_release_500rjg2_16072025 · Reddit Post
• https://twitter.com/CVEnew/status/1944644385729077319 · Twitter Post