CVE-2025-64758

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64758", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-10T22:29:34.875Z", "datePublished": "2025-11-17T17:24:27.491Z", "dateUpdated": "2025-11-17T21:05:16.691Z"}, "containers": {"cna": {"title": "@dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5"}, {"name": "https://github.com/DependencyTrack/frontend/pull/1378", "tags": ["x_refsource_MISC"], "url": "https://github.com/DependencyTrack/frontend/pull/1378"}, {"name": "https://github.com/DependencyTrack/frontend/pull/986", "tags": ["x_refsource_MISC"], "url": "https://github.com/DependencyTrack/frontend/pull/986"}, {"name": "https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be", "tags": ["x_refsource_MISC"], "url": "https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be"}], "affected": [{"vendor": "DependencyTrack", "product": "frontend", "versions": [{"version": ">= 4.12.0, < 4.13.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-17T17:24:27.491Z"}, "descriptions": [{"lang": "en", "value": "@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a \"welcome message\", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed. Users with the SYSTEM_CONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page. The issue has been fixed in version 4.13.6."}], "source": {"advisory": "GHSA-7xvh-c266-cfr5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-17T21:05:00.585584Z", "id": "CVE-2025-64758", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-17T21:05:16.691Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-17T21:05:00.585584Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-17T21:05:10.920Z"}}], "cna": {"title": "@dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message", "source": {"advisory": "GHSA-7xvh-c266-cfr5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "DependencyTrack", "product": "frontend", "versions": [{"status": "affected", "version": ">= 4.12.0, < 4.13.6"}]}], "references": [{"url": "https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5", "name": "https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/DependencyTrack/frontend/pull/1378", "name": "https://github.com/DependencyTrack/frontend/pull/1378", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DependencyTrack/frontend/pull/986", "name": "https://github.com/DependencyTrack/frontend/pull/986", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be", "name": "https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a \"welcome message\", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed. Users with the SYSTEM_CONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page. The issue has been fixed in version 4.13.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-17T17:24:27.491Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64758", "state": "PUBLISHED", "dateUpdated": "2025-11-17T21:05:16.691Z", "dateReserved": "2025-11-10T22:29:34.875Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-17T17:24:27.491Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "frontend", "vendor": "DependencyTrack", "versions": [{"status": "affected", "version": ">= 4.12.0, < 4.13.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a \"welcome message\", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed. Users with the SYSTEM_CONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page. The issue has been fixed in version 4.13.6."}, {"lang": "es", "value": "@dependencytrack/frontend es una Aplicaci\u00f3n de P\u00e1gina \u00danica (SPA) utilizada en Dependency-Track, una plataforma de An\u00e1lisis de Componentes de c\u00f3digo abierto que permite a las organizaciones identificar y reducir el riesgo en la cadena de suministro de software. Desde la versi\u00f3n 4.12.0, los usuarios de Dependency-Track con el permiso SYSTEM_CONFIGURATION pueden configurar un \u201cmensaje de bienvenida\u201d, que es HTML que se renderizar\u00e1 en la p\u00e1gina de inicio de sesi\u00f3n con fines de marca. Al renderizar el mensaje de bienvenida, las versiones de Dependency-Track anteriores a la 4.13.6 no sanitizaban correctamente el HTML, permitiendo la ejecuci\u00f3n de JavaScript arbitrario. Los usuarios con el permiso SYSTEM_CONFIGURATION (es decir, administradores) pueden exploit esta vulnerabilidad para ejecutar JavaScript arbitrario para los usuarios que navegan a la p\u00e1gina de inicio de sesi\u00f3n. El problema ha sido solucionado en la versi\u00f3n 4.13.6."}], "id": "CVE-2025-64758", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64758", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-17T21:05:00.585584Z", "version": "2.0.3"}}]}, "published": "2025-11-17T18:15:58.450", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be"}, {"source": "security-advisories@github.com", "url": "https://github.com/DependencyTrack/frontend/pull/1378"}, {"source": "security-advisories@github.com", "url": "https://github.com/DependencyTrack/frontend/pull/986"}, {"source": "security-advisories@github.com", "url": "https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-11-18T09:06:06.654017+00:00", "updated": "2025-11-18T09:06:06.654043+00:00", "vendors": ["owasp", "owasp$PRODUCT$dependency-track_frontend"]}