PT-2025-22352 · Unknown · Konsola Proget

Marcin Węgłowski · Published 2025-05-21 · Updated 2025-05-21 · CVE-2025-1420

Positive Technologies (AI Summary)

CVSS v4.0

2.4

Low

Base vector

AV:A/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Konsola Proget versions prior to 2.17.5

Description The issue arises from input in the activationMessage field not being sanitized correctly in Konsola Proget, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.

Recommendations For versions prior to 2.17.5, update to version 2.17.5 to resolve the issue. As a temporary workaround, consider restricting access to the activationMessage field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-1420

Affected Products

Konsola Proget

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-1420 · Security Note
• https://twitter.com/CVEnew/status/1925185820232646842 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925222460628054020 · Twitter Post
• https://proget.pl/en/mobile-device-management · Note
• https://t.me/cvetracker/24367 · Telegram Post
• https://cert.pl/en/posts/2025/05/CVE-2025-1415 · Note