CVE-2025-12454

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12454", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2025-10-28T21:28:35.834Z", "datePublished": "2026-03-13T18:30:40.822Z", "dateUpdated": "2026-03-13T19:33:59.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2026-03-13T18:30:40.822Z"}, "title": "Improper neutralization of input during web page generation vulnerability has been discovered in OpenText\u2122 Vertica.", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "affected": [{"vendor": "OpenText\u2122", "product": "Vertica", "versions": [{"status": "affected", "version": "10.0", "lessThanOrEqual": "10.x", "versionType": "custom"}, {"status": "affected", "version": "11.0", "lessThanOrEqual": "11.x", "versionType": "custom"}, {"status": "affected", "version": "12.0", "lessThanOrEqual": "12.x", "versionType": "custom"}, {"status": "affected", "version": "23.0", "lessThanOrEqual": "23.x", "versionType": "custom"}, {"status": "affected", "version": "24.0", "lessThanOrEqual": "24.x", "versionType": "custom"}, {"status": "affected", "version": "25.1.0", "lessThanOrEqual": "25.1.x", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.\u00a0\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.&nbsp;\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.<p>This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X.</p>"}]}], "references": [{"url": "https://portal.microfocus.com/s/article/KM000045853?language=en_US"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "USER", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U"}}], "solutions": [{"lang": "en", "value": "https://portal.microfocus.com/s/article/KM000045853?language=en_US", "supportingMedia": [{"type": "text/html", "base64": false, "value": "https://portal.microfocus.com/s/article/KM000045853?language=en_US"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:33:51.059348Z", "id": "CVE-2025-12454", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:33:59.150Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12454", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T19:33:51.059348Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:33:55.414Z"}}], "cna": {"title": "Improper neutralization of input during web page generation vulnerability has been discovered in OpenText\u2122 Vertica.", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.1, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenText\u2122", "product": "Vertica", "versions": [{"status": "affected", "version": "10.0", "versionType": "custom", "lessThanOrEqual": "10.x"}, {"status": "affected", "version": "11.0", "versionType": "custom", "lessThanOrEqual": "11.x"}, {"status": "affected", "version": "12.0", "versionType": "custom", "lessThanOrEqual": "12.x"}, {"status": "affected", "version": "23.0", "versionType": "custom", "lessThanOrEqual": "23.x"}, {"status": "affected", "version": "24.0", "versionType": "custom", "lessThanOrEqual": "24.x"}, {"status": "affected", "version": "25.1.0", "versionType": "custom", "lessThanOrEqual": "25.1.x"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "https://portal.microfocus.com/s/article/KM000045853?language=en_US", "supportingMedia": [{"type": "text/html", "value": "https://portal.microfocus.com/s/article/KM000045853?language=en_US", "base64": false}]}], "references": [{"url": "https://portal.microfocus.com/s/article/KM000045853?language=en_US"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.\u00a0\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.&nbsp;\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.<p>This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2026-03-13T18:30:40.822Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12454", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:33:59.150Z", "dateReserved": "2025-10-28T21:28:35.834Z", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "datePublished": "2026-03-13T18:30:40.822Z", "assignerShortName": "OpenText"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Vertica", "vendor": "OpenText\u2122", "versions": [{"lessThanOrEqual": "10.x", "status": "affected", "version": "10.0", "versionType": "custom"}, {"lessThanOrEqual": "11.x", "status": "affected", "version": "11.0", "versionType": "custom"}, {"lessThanOrEqual": "12.x", "status": "affected", "version": "12.0", "versionType": "custom"}, {"lessThanOrEqual": "23.x", "status": "affected", "version": "23.0", "versionType": "custom"}, {"lessThanOrEqual": "24.x", "status": "affected", "version": "24.0", "versionType": "custom"}, {"lessThanOrEqual": "25.1.x", "status": "affected", "version": "25.1.0", "versionType": "custom"}]}], "source": "security@opentext.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opentext:vertica:*:*:*:*:*:*:*:*", "matchCriteriaId": "75CD9DEF-0100-4010-BB1F-2960D27E99D0", "versionEndExcluding": "25.2.0", "versionStartIncluding": "10.0.0-0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText\u2122 Vertica allows Reflected XSS.\u00a0\nThe vulnerability could lead to Reflected XSS attack of cross-site scripting in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X, from 25.1.0 through 25.1.X."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web ('cross-site scripting') vulnerabilidad en OpenText\u2122 Vertica permite XSS Reflejado. La vulnerabilidad podr\u00eda conducir a un ataque de XSS Reflejado de cross-site scripting en la aplicaci\u00f3n de consola de gesti\u00f3n de Vertica. Este problema afecta a Vertica: desde 10.0 hasta 10.X, desde 11.0 hasta 11.X, desde 12.0 hasta 12.X, desde 23.0 hasta 23.X, desde 24.0 hasta 24.X, desde 25.1.0 hasta 25.1.X."}], "id": "CVE-2025-12454", "lastModified": "2026-06-17T08:32:24.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@opentext.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12454", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:33:51.059348Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:53:47.667", "references": [{"source": "security@opentext.com", "tags": ["Vendor Advisory"], "url": "https://portal.microfocus.com/s/article/KM000045853?language=en_US"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@opentext.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.0,10.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.0,11.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[12.0,12.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[23.0,23.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[24.0,24.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.1.0,25.1.x]"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Vertica", "source": "cna", "vendor": "OpenText\u2122"}, "product": "vertica", "vendor": "opentext"}], "analysis": {"en": {"generated_at": "2026-03-19T14:37:10.599894+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch as outlined in the MicroFocus support article at https://portal.microfocus.com/s/article/KM000045853?language=en_US", "If a patch is not yet available, implement stricter input validation or a web application firewall to block injected scripts on the Vertica management console", "Restrict access to the Vertica management console to trusted IP ranges or VPN endpoints to reduce exposure"], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting (Reflected XSS)"}, "threat_synthesis": {"affected_systems": "Affected products are OpenText Vertica versions from 10.0 through 10.X, 11.0 through 11.X, 12.0 through 12.X, 23.0 through 23.X, 24.0 through 24.X, and 25.1.0 through 25.1.X.", "description_and_impact": "The vulnerability originates from improper neutralization of input during web page generation in the OpenText Vertica management console. According to the vendor description, it permits reflected cross\u2011site scripting (XSS) where an attacker can inject malicious scripts into a response that is returned to a victim\u2019s browser. This could lead to session hijacking, data theft, or unauthorized actions performed in the context of the authenticated user.", "risk_and_exploitability": "The CVSS score of 5.1 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would occur via the management console\u2019s web interface and requires a victim to visit a crafted link or execute code within the console, implying user interaction is necessary. The lack of remote code execution and the requirement for authentication or access to the console limit the overall threat surface, but the impact remains significant for exposed management interfaces."}}}}, "created": "2026-03-16T09:24:41.339296+00:00", "updated": "2026-03-23T13:40:32.140848+00:00", "vendors": ["opentext", "opentext$PRODUCT$vertica"]}