PT-2025-22528 · Unknown · Group-Office

Kh0Kamoni · Published 2025-05-22 · Updated 2025-05-30 · CVE-2025-48368

Positive Technologies (AI Summary)

CVSS v4.0

6.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.119 Group-Office versions prior to 25.0.20

Description A DOM-based Cross-Site Scripting (XSS) issue exists in the Group-Office application, allowing attackers to execute arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability can be triggered by injecting a crafted payload into a parameter that is later processed unsafely in the DOM.

Recommendations For versions prior to 6.8.119, update to version 6.8.119 or later to resolve the issue. For versions prior to 25.0.20, update to version 25.0.20 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-48368

GHSA-C49J-QVP9-VGG6

Affected Products

Group-Office

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48368.json · Exploit
• 🔥 https://github.com/Intermesh/groupoffice/security/advisories/GHSA-c49j-qvp9-vgg6 · Exploit
• https://osv.dev/vulnerability/CVE-2025-48368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48368 · Security Note
• https://twitter.com/dailycve/status/1928279933169684791 · Twitter Post
• https://twitter.com/CVEnew/status/1925610245188932004 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925754946919526499 · Twitter Post