CVE-2025-59428

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59428", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-15T19:13:16.905Z", "datePublished": "2025-10-14T14:38:20.090Z", "dateUpdated": "2025-10-14T16:03:42.715Z"}, "containers": {"cna": {"title": "EspoCRM allows arbitrary user creation via stored SVG injection and CSRF", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r"}], "affected": [{"vendor": "espocrm", "product": "espocrm", "versions": [{"version": "< 9.1.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-14T14:38:20.090Z"}, "descriptions": [{"lang": "en", "value": "EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element containing a link in the body field of an article. When an authenticated user clicks the malicious link, they are redirected to an attacker-controlled HTML page that executes a CSRF request against the api/v1/User endpoint. If the victim is prompted for and enters their credentials, an attacker-controlled account is created with privileges determined by the CSRF payload. This issue has been patched in version 9.1.9."}], "source": {"advisory": "GHSA-c26c-wvhr-fr6r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T16:03:30.276369Z", "id": "CVE-2025-59428", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T16:03:42.715Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59428", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T16:03:30.276369Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T16:03:34.337Z"}}], "cna": {"title": "EspoCRM allows arbitrary user creation via stored SVG injection and CSRF", "source": {"advisory": "GHSA-c26c-wvhr-fr6r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "espocrm", "product": "espocrm", "versions": [{"status": "affected", "version": "< 9.1.9"}]}], "references": [{"url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r", "name": "https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element containing a link in the body field of an article. When an authenticated user clicks the malicious link, they are redirected to an attacker-controlled HTML page that executes a CSRF request against the api/v1/User endpoint. If the victim is prompted for and enters their credentials, an attacker-controlled account is created with privileges determined by the CSRF payload. This issue has been patched in version 9.1.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-14T14:38:20.090Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59428", "state": "PUBLISHED", "dateUpdated": "2025-10-14T16:03:42.715Z", "dateReserved": "2025-09-15T19:13:16.905Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-14T14:38:20.090Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "espocrm", "vendor": "espocrm", "versions": [{"status": "affected", "version": "< 9.1.9"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*", "matchCriteriaId": "8F85634C-E414-4BFA-9A30-987F87598B01", "versionEndExcluding": "9.1.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element containing a link in the body field of an article. When an authenticated user clicks the malicious link, they are redirected to an attacker-controlled HTML page that executes a CSRF request against the api/v1/User endpoint. If the victim is prompted for and enters their credentials, an attacker-controlled account is created with privileges determined by the CSRF payload. This issue has been patched in version 9.1.9."}, {"lang": "es", "value": "EspoCRM es una aplicaci\u00f3n de gesti\u00f3n de relaciones con clientes de c\u00f3digo abierto. En versiones anteriores a la 9.1.9, una vulnerabilidad permite la creaci\u00f3n arbitraria de usuarios, incluyendo cuentas administrativas, a trav\u00e9s de una combinaci\u00f3n de inyecci\u00f3n SVG almacenada y la falta de protecci\u00f3n CSRF. Un atacante con permisos de edici\u00f3n de la Base de Conocimiento puede incrustar un elemento SVG malicioso que contiene un enlace en el campo de cuerpo de un art\u00edculo. Cuando un usuario autenticado hace clic en el enlace malicioso, es redirigido a una p\u00e1gina HTML controlada por el atacante que ejecuta una solicitud CSRF contra el endpoint API/v1/User. Si se le solicita a la v\u00edctima sus credenciales y las introduce, se crea una cuenta controlada por el atacante con privilegios determinados por la carga \u00fatil CSRF. Este problema ha sido parcheado en la versi\u00f3n 9.1.9."}], "id": "CVE-2025-59428", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59428", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T16:03:30.276369Z", "version": "2.0.3"}}]}, "published": "2025-10-14T15:16:11.673", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-10-20T15:49:32.649991+00:00", "updated": "2025-10-20T15:49:32.650017+00:00", "vendors": ["espocrm", "espocrm$PRODUCT$espocrm"]}