CVE-2025-12453

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12453", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2025-10-28T21:28:28.343Z", "datePublished": "2026-03-13T18:30:53.495Z", "dateUpdated": "2026-03-13T19:34:21.690Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2026-03-13T18:30:53.495Z"}, "title": "Improper neutralization of input during web page generation vulnerability has been discovered in OpenText\u2122 Vertica.", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "affected": [{"vendor": "OpenText\u2122", "product": "Vertica", "versions": [{"status": "affected", "version": "10.0", "lessThanOrEqual": "10.x", "versionType": "custom"}, {"status": "affected", "version": "11.0", "lessThanOrEqual": "11.x", "versionType": "custom"}, {"status": "affected", "version": "12.0", "lessThanOrEqual": "12.x", "versionType": "custom"}, {"status": "affected", "version": "23.0", "lessThanOrEqual": "23.x", "versionType": "custom"}, {"status": "affected", "version": "24.0", "lessThanOrEqual": "24.x", "versionType": "custom"}, {"status": "affected", "version": "25.1.0", "lessThanOrEqual": "25.1.x", "versionType": "custom"}, {"status": "affected", "version": "25.2.0", "lessThanOrEqual": "25.2.x", "versionType": "custom"}, {"status": "affected", "version": "25.3.0", "lessThanOrEqual": "25.3.x", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.\u00a0\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X, from 25.2.0 through 25.2.X, from 25.3.0 through 25.3.X.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.&nbsp;\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.<p>This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X, from 25.2.0 through 25.2.X, from 25.3.0 through 25.3.X.</p>"}]}], "references": [{"url": "https://portal.microfocus.com/s/article/KM000045852?language=en_US"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "USER", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U"}}], "solutions": [{"lang": "en", "value": "https://portal.microfocus.com/s/article/KM000045852?language=en_US", "supportingMedia": [{"type": "text/html", "base64": false, "value": "https://portal.microfocus.com/s/article/KM000045852?language=en_US"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:34:12.635859Z", "id": "CVE-2025-12453", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:34:21.690Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12453", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T19:34:12.635859Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:34:17.548Z"}}], "cna": {"title": "Improper neutralization of input during web page generation vulnerability has been discovered in OpenText\u2122 Vertica.", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.1, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenText\u2122", "product": "Vertica", "versions": [{"status": "affected", "version": "10.0", "versionType": "custom", "lessThanOrEqual": "10.x"}, {"status": "affected", "version": "11.0", "versionType": "custom", "lessThanOrEqual": "11.x"}, {"status": "affected", "version": "12.0", "versionType": "custom", "lessThanOrEqual": "12.x"}, {"status": "affected", "version": "23.0", "versionType": "custom", "lessThanOrEqual": "23.x"}, {"status": "affected", "version": "24.0", "versionType": "custom", "lessThanOrEqual": "24.x"}, {"status": "affected", "version": "25.1.0", "versionType": "custom", "lessThanOrEqual": "25.1.x"}, {"status": "affected", "version": "25.2.0", "versionType": "custom", "lessThanOrEqual": "25.2.x"}, {"status": "affected", "version": "25.3.0", "versionType": "custom", "lessThanOrEqual": "25.3.x"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "https://portal.microfocus.com/s/article/KM000045852?language=en_US", "supportingMedia": [{"type": "text/html", "value": "https://portal.microfocus.com/s/article/KM000045852?language=en_US", "base64": false}]}], "references": [{"url": "https://portal.microfocus.com/s/article/KM000045852?language=en_US"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.\u00a0\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X, from 25.2.0 through 25.2.X, from 25.3.0 through 25.3.X.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.&nbsp;\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.<p>This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X, from 25.2.0 through 25.2.X, from 25.3.0 through 25.3.X.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2026-03-13T18:30:53.495Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12453", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:34:21.690Z", "dateReserved": "2025-10-28T21:28:28.343Z", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "datePublished": "2026-03-13T18:30:53.495Z", "assignerShortName": "OpenText"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Vertica", "vendor": "OpenText\u2122", "versions": [{"lessThanOrEqual": "10.x", "status": "affected", "version": "10.0", "versionType": "custom"}, {"lessThanOrEqual": "11.x", "status": "affected", "version": "11.0", "versionType": "custom"}, {"lessThanOrEqual": "12.x", "status": "affected", "version": "12.0", "versionType": "custom"}, {"lessThanOrEqual": "23.x", "status": "affected", "version": "23.0", "versionType": "custom"}, {"lessThanOrEqual": "24.x", "status": "affected", "version": "24.0", "versionType": "custom"}, {"lessThanOrEqual": "25.1.x", "status": "affected", "version": "25.1.0", "versionType": "custom"}, {"lessThanOrEqual": "25.2.x", "status": "affected", "version": "25.2.0", "versionType": "custom"}, {"lessThanOrEqual": "25.3.x", "status": "affected", "version": "25.3.0", "versionType": "custom"}]}], "source": "security@opentext.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opentext:vertica:*:*:*:*:*:*:*:*", "matchCriteriaId": "985580D2-2949-44DF-AE4B-108FBEACF4F5", "versionEndExcluding": "25.4.0-0", "versionStartIncluding": "10.0.0-0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.\u00a0\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X, from 25.2.0 through 25.2.X, from 25.3.0 through 25.3.X."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web ('cross-site scripting') vulnerabilidad en OpenText\u2122 Vertica permite XSS Reflejado. La vulnerabilidad podr\u00eda conducir a un ataque de XSS Reflejado de cross-site scripting en la aplicaci\u00f3n de consola de gesti\u00f3n de Vertica. Este problema afecta a Vertica: desde 10.0 hasta 10.X, desde 11.0 hasta 11.X, desde 12.0 hasta 12.X, desde 23.0 hasta 23.X, desde 24.0 hasta 24.X, desde 25.1.0 hasta 25.1.X, desde 25.2.0 hasta 25.2.X, desde 25.3.0 hasta 25.3.X."}], "id": "CVE-2025-12453", "lastModified": "2026-06-17T08:32:24.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@opentext.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12453", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:34:12.635859Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:53:47.427", "references": [{"source": "security@opentext.com", "tags": ["Vendor Advisory"], "url": "https://portal.microfocus.com/s/article/KM000045852?language=en_US"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@opentext.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.0,10.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.0,11.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[12.0,12.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[23.0,23.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[24.0,24.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.1.0,25.1.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.2.0,25.2.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.3.0,25.3.x]"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Vertica", "source": "cna", "vendor": "OpenText\u2122"}, "product": "vertica", "vendor": "opentext"}], "analysis": {"en": {"generated_at": "2026-03-19T15:06:05.139172+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch or upgrade to a fixed version using the link: https://portal.microfocus.com/s/article/KM000045852?language=en_US", "Verify that the patch was successfully installed and the application is running a non\u2011affected version"], "summary": {"action": "Patch", "impact": "Reflected Cross\u2011Site Scripting in web console"}, "threat_synthesis": {"affected_systems": "OpenText Vertica is affected from version 10.0 through 10.X, 11.0 through 11.X, 12.0 through 12.X, 23.0 through 23.X, 24.0 through 24.X, 25.1.0 through 25.1.X, 25.2.0 through 25.2.X, and 25.3.0 through 25.3.X.", "description_and_impact": "Improper neutralization of input during web page generation in the OpenText Vertica management console allows reflected cross\u2011site scripting. An attacker could inject malicious JavaScript that executes in the victim\u2019s browser context, potentially leading to session hijacking, data theft, or unauthorized actions performed on behalf of the user. This vulnerability represents a typical reflected XSS weakness (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 5.1 indicates a moderately serious impact. An EPSS score of less than 1% shows a low likelihood of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attack surface is a web interface, the likely vector is a victim clicking a crafted link or visiting a malicious site that triggers the reflected payload. Exploitation requires user interaction and does not need elevated privileges within the Vertica environment."}}}}, "created": "2026-03-16T09:24:40.153026+00:00", "updated": "2026-03-23T13:40:30.834923+00:00", "vendors": ["opentext", "opentext$PRODUCT$vertica"]}