PT-2025-4863 · Unknown · Exif Viewer Classic

Kouhei Morita + 1 · Published 2025-01-29 · Updated 2025-01-29 · CVE-2025-23362

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EXIF Viewer Classic versions 2.3.2 through 2.4.0

Description The issue is caused by improper handling of EXIF meta data, leading to a cross-site scripting vulnerability. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser.

Recommendations For versions 2.3.2 and 2.4.0, consider updating to a version newer than 2.4.0, as the product has been refactored and version 3.0.1 is not vulnerable. As a temporary workaround, consider disabling the rendering of EXIF meta data until a patch is available. Restrict access to the image rendering functionality to minimize the risk of exploitation. Avoid using the affected EXIF Viewer Classic versions to process crafted images until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23362

Affected Products

Exif Viewer Classic

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-23362 · Security Note
• https://twitter.com/VulmonFeeds/status/1884438672038109222 · Twitter Post
• https://exifviewers.com · Note
• https://t.me/cvedetector/16664 · Telegram Post
• https://jvn.jp/en/jp/JVN05508012 · Note
• https://t.me/cvenotify/108946 · Telegram Post
• https://chromewebstore.google.com/detail/exif-viewer-classic/nafpfdcmppffipmhcpkbplhkoiekndck · Note
• https://twitter.com/CVEnew/status/1884424346673799236 · Twitter Post