PT-2025-17871 · Unknown · Sherpa Orchestrator

Artem Brylev + 1 · Published 2025-04-25 · Updated 2025-04-25 · CVE-2025-46545

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sherpa Orchestrator version 141851

Description The issue allows for stored XSS attacks by an administrator through the name parameter when adding or updating licenses. The XSS payload can execute when the license expires.

Recommendations For Sherpa Orchestrator version 141851, avoid using the name parameter in the license addition or update functionality until a fix is available. As a temporary workaround, consider restricting access to the license management feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-46545

Affected Products

Sherpa Orchestrator

References · 11

• https://osv.dev/vulnerability/CVE-2025-46545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46545 · Security Note
• https://sherparpa.com · Note
• https://deiteriy.com · Note
• https://twitter.com/CVEnew/status/1915614841785417741 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1915617139966312925 · Twitter Post
• https://t.me/cvenotify/119760 · Telegram Post
• https://t.me/cvedetector/23723 · Telegram Post
• https://twitter.com/ArtyomBrylev · Note
• https://gist.github.com/ArtemBrylev/5a0c76285d5fa9daf4ec753034185de7 · Note
• https://t.me/cvetracker/22339 · Telegram Post