PT-2025-4484 · Optimizely · Episerver.Cms.Core

Published 2025-01-04 · Updated 2025-01-06 · CVE-2025-22388

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Optimizely EPiServer.CMS.Core versions prior to 12.22.0

Description A high-severity Stored Cross-Site Scripting (XSS) issue exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads.

Recommendations For versions prior to 12.22.0, update to version 12.22.0 or later to resolve the issue. As a temporary workaround, consider restricting access to content editing, link management, and file uploads to minimize the risk of exploitation. Avoid using potentially vulnerable features in these areas until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22388

Affected Products

Episerver.Cms.Core

References · 7

• https://osv.dev/vulnerability/CVE-2025-22388 · Vendor Advisory
• https://support.optimizely.com/hc/en-us/articles/33182047260557-Content-Management-System-CMS-Security-Advisory-CMS-2025-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22388 · Security Note
• https://twitter.com/CVEnew/status/1875375484466569660 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1875371288295797232 · Twitter Post
• https://t.me/cvenotify/106295 · Telegram Post
• https://t.me/cvedetector/14255 · Telegram Post