CVE-2025-34281

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2025-34281", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-04-15T19:15:22.581Z", "datePublished": "2025-10-17T18:33:03.941Z", "dateUpdated": "2026-02-10T15:32:17.457Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "thingsboard", "repo": "https://github.com/thingsboard/thingsboard", "vendor": "thingsboard", "versions": [{"lessThan": "4.2.1", "status": "affected", "version": "0", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thingsboard:thingsboard:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.2.1", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Jo\u00e3o Oliveira from Checkmarx Security Research Group"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the \"Image Gallery\", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions."}], "value": "ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the \"Image Gallery\", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.2, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "shortName": "Checkmarx", "dateUpdated": "2026-02-10T15:32:17.457Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://advisory.checkmarx.net/advisory/CVE-2025-34281/"}, {"tags": ["patch"], "url": "https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03"}, {"tags": ["release-notes"], "url": "https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored Cross-Site Scripting (XSS) in ThingsBoard", "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-17T18:58:41.437131Z", "id": "CVE-2025-34281", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T18:59:51.297Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-34281", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-17T18:58:41.437131Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T18:59:48.159Z"}}], "cna": {"title": "Stored Cross-Site Scripting (XSS) in ThingsBoard", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jo\u00e3o Oliveira from Checkmarx Security Research Group"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/thingsboard/thingsboard", "vendor": "thingsboard", "product": "thingsboard", "versions": [{"status": "affected", "version": "0", "lessThan": "4.2.1", "versionType": "git"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://advisory.checkmarx.net/advisory/CVE-2025-34281/", "tags": ["third-party-advisory"]}, {"url": "https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03", "tags": ["patch"]}, {"url": "https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1", "tags": ["release-notes"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the \"Image Gallery\", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.", "supportingMedia": [{"type": "text/html", "value": "ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the \"Image Gallery\", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thingsboard:thingsboard:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.2.1", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "shortName": "Checkmarx", "dateUpdated": "2026-02-10T15:32:17.457Z"}}}, "cveMetadata": {"cveId": "CVE-2025-34281", "state": "PUBLISHED", "dateUpdated": "2026-02-10T15:32:17.457Z", "dateReserved": "2025-04-15T19:15:22.581Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-10-17T18:33:03.941Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "thingsboard", "repo": "https://github.com/thingsboard/thingsboard", "vendor": "thingsboard", "versions": [{"lessThan": "4.2.1", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thingsboard:thingsboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "DCE4C513-C695-4227-B5E7-BBD2EC014DF8", "versionEndExcluding": "4.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the \"Image Gallery\", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions."}, {"lang": "es", "value": "ThingsBoard en versiones anteriores a v4.2.1 permite a un usuario autenticado cargar im\u00e1genes SVG maliciosas a trav\u00e9s de la 'Galer\u00eda de im\u00e1genes', lo que lleva a una vulnerabilidad de Cross-Site Scripting Almacenado (XSS). El exploit puede activarse cuando cualquier usuario accede al endpoint de la API p\u00fablica de las im\u00e1genes SVG maliciosas, o si las im\u00e1genes maliciosas se incrustan en un elemento 'iframe', durante la creaci\u00f3n de un widget, desplegado en cualquier p\u00e1gina de la plataforma (p. ej., paneles de control), y se accede a ellas durante las operaciones normales. La vulnerabilidad reside en el 'ImageController', que no restringe la ejecuci\u00f3n de c\u00f3digo JavaScript cuando una imagen es cargada por el navegador del usuario. Esta vulnerabilidad puede llevar a la ejecuci\u00f3n de c\u00f3digo malicioso en el contexto de las sesiones de otros usuarios, comprometiendo potencialmente sus cuentas y permitiendo acciones no autorizadas."}], "id": "CVE-2025-34281", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34281", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-17T18:58:41.437131Z", "version": "2.0.3"}}]}, "published": "2025-10-17T19:15:37.197", "references": [{"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://advisory.checkmarx.net/advisory/CVE-2025-34281/"}, {"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "url": "https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03"}, {"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "tags": ["Release Notes"], "url": "https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1"}], "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "type": "Secondary"}]}

{}

{"created": "2025-10-20T13:21:53.222880+00:00", "updated": "2025-10-20T13:21:53.222906+00:00", "vendors": ["thingsboard", "thingsboard$PRODUCT$thingsboard"]}