CVE-2025-52557

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-52557", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-06-18T03:55:52.035Z", "datePublished": "2025-06-21T01:42:23.004Z", "dateUpdated": "2025-06-23T17:41:29.958Z"}, "containers": {"cna": {"title": "Mail-0 Zero Session Hijacking Via Email", "problemTypes": [{"descriptions": [{"cweId": "CWE-1384", "lang": "en", "description": "CWE-1384: Improper Handling of Physical or Environmental Conditions", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85"}, {"name": "https://github.com/Mail-0/Zero/pull/1386", "tags": ["x_refsource_MISC"], "url": "https://github.com/Mail-0/Zero/pull/1386"}, {"name": "https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f", "tags": ["x_refsource_MISC"], "url": "https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f"}], "affected": [{"vendor": "Mail-0", "product": "Zero", "versions": [{"version": "= 0.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-06-21T01:42:23.004Z"}, "descriptions": [{"lang": "en", "value": "Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81."}], "source": {"advisory": "GHSA-34gh-g567-hq85", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-23T17:41:13.338469Z", "id": "CVE-2025-52557", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-23T17:41:29.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-52557", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-23T17:41:13.338469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-23T17:41:20.499Z"}}], "cna": {"title": "Mail-0 Zero Session Hijacking Via Email", "source": {"advisory": "GHSA-34gh-g567-hq85", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Mail-0", "product": "Zero", "versions": [{"status": "affected", "version": "= 0.8"}]}], "references": [{"url": "https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85", "name": "https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Mail-0/Zero/pull/1386", "name": "https://github.com/Mail-0/Zero/pull/1386", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f", "name": "https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1384", "description": "CWE-1384: Improper Handling of Physical or Environmental Conditions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-06-21T01:42:23.004Z"}}}, "cveMetadata": {"cveId": "CVE-2025-52557", "state": "PUBLISHED", "dateUpdated": "2025-06-23T17:41:29.958Z", "dateReserved": "2025-06-18T03:55:52.035Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-06-21T01:42:23.004Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Zero", "vendor": "Mail-0", "versions": [{"status": "affected", "version": "= 0.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81."}, {"lang": "es", "value": "Zero de Mail-0 es una soluci\u00f3n de correo electr\u00f3nico de c\u00f3digo abierto. En la versi\u00f3n 0.8, un atacante puede manipular un correo electr\u00f3nico que ejecute JavaScript, lo que puede provocar el secuestro de la sesi\u00f3n debido a una depuraci\u00f3n incorrecta. Este problema se ha corregido en la versi\u00f3n 0.81."}], "id": "CVE-2025-52557", "lastModified": "2026-06-17T09:36:40.317", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-52557", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-23T17:41:13.338469Z", "version": "2.0.3"}}]}, "published": "2025-06-21T02:15:20.107", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f"}, {"source": "security-advisories@github.com", "url": "https://github.com/Mail-0/Zero/pull/1386"}, {"source": "security-advisories@github.com", "url": "https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1384"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}