PT-2025-47034 · Unknown · Application Server

Published 2025-11-14 · Updated 2025-11-15 · CVE-2025-8386

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Application Server (affected versions not specified)

Description An authenticated attacker with “aaConfigTools” privilege can modify App Objects’ help files, potentially leading to a persistent cross-site scripting (XSS) injection. Successful exploitation by a victim user could result in horizontal or vertical privilege escalation. The issue is limited to config-time operations within the IDE component of the Application Server and does not affect run-time components or operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-8386

Affected Products

Application Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-8386 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-02.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-317-02 · Note
• https://t.me/CVEtracker/37395 · Telegram Post
• https://aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin-AVEVA-2025-005.pdf · Note
• https://twitter.com/CVEnew/status/1989500414027235346 · Twitter Post