PT-2025-48399 · Unknown · Deco-Cx Apps

Cucumbersalad · CVE-2025-13796 · Published 2025-11-30 · Updated 2025-12-01

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions deco-cx apps versions up to 0.120.1

Description A security issue exists in deco-cx apps. Manipulation of the url argument within the AnalyticsScript function, located in the website/loaders/analyticsScript.ts file of the Parameter Handler component, can lead to server-side request forgery. This attack can be carried out remotely. The exploit for this issue has been publicly disclosed.

Recommendations Upgrade to version 0.120.2 to address this issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-13796

Affected Products

Deco-Cx Apps

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13796.json · Exploit
• https://github.com/deco-cx/apps/releases/tag/0.120.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-13796 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13796 · Vendor Advisory
• https://github.com/deco-cx/apps/pull/1360 · Note
• https://vuldb.com/?ctiid.333807 · Note
• https://t.me/CVEtracker/38496 · Telegram Post
• https://twitter.com/CVEnew/status/1995279276384387174 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1995289555948216352 · Twitter Post
• https://vuldb.com/?id.333807 · Note
• https://t.me/cveNotify/144353 · Telegram Post
• https://vuldb.com/?submit.691837 · Note