CVE-2025-2745 (GCVE-0-2025-2745)
Vulnerability from cvelistv5
Published
2025-06-12 19:42
Modified
2025-06-12 20:09
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
4.5 (Medium) - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
CWE
Summary
A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered to disable content security policy protections while rendering annotation attachments from within a web browser.
References
Impacted products
Vendor Product Version
AVEVA PI Web API Version: 0   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-12T20:09:20.915656Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-12T20:09:34.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PI Web API",
          "vendor": "AVEVA",
          "versions": [
            {
              "lessThanOrEqual": "2023 SP1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AVEVA reported this vulnerability to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A cross-site scripting vulnerability exists in AVEVA\u0026nbsp;PI Web API version 2023 \nSP1 and prior that, if exploited, could allow an authenticated attacker \n(with privileges to create/update annotations or upload media files) to \npersist arbitrary JavaScript code that will be executed by users who \nwere socially engineered to disable content security policy protections \nwhile rendering annotation attachments from within a web browser."
            }
          ],
          "value": "A cross-site scripting vulnerability exists in AVEVA\u00a0PI Web API version 2023 \nSP1 and prior that, if exploited, could allow an authenticated attacker \n(with privileges to create/update annotations or upload media files) to \npersist arbitrary JavaScript code that will be executed by users who \nwere socially engineered to disable content security policy protections \nwhile rendering annotation attachments from within a web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-12T19:42:27.001Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08"
        },
        {
          "url": "https://www.aveva.com/en/support-and-success/cyber-security-updates/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAVEVA recommends that organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.\u003c/p\u003e\u003cp\u003eFrom \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://my.osisoft.com/\"\u003eOSISoft Customer Portal\u003c/a\u003e, search for \"PI Web API\" and select version 2023 SP1 Patch 1 or higher.\u0026nbsp;\u003cbr\u003e\nFor additional information please refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.aveva.com/en/support-and-success/cyber-security-updates/\"\u003eAVEVA-2025-003\u003c/a\u003e.\n\n\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "AVEVA recommends that organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.\n\nFrom  OSISoft Customer Portal https://my.osisoft.com/ , search for \"PI Web API\" and select version 2023 SP1 Patch 1 or higher.\u00a0\n\nFor additional information please refer to  AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ ."
        }
      ],
      "source": {
        "advisory": "ICSA-25-162-08",
        "discovery": "INTERNAL"
      },
      "title": "AVEVA PI Web API Cross-site Scripting",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAVEVA further recommends users follow general defensive measures:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eReview and update the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1022248.html\"\u003efile extensions allowlist\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cli\u003e for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, ...).\u003c/li\u003e\n\u003cli\u003eConsider implementing IT policies that would prevent users from \nsubverting/disabling content security policy browser protections.\u003c/li\u003e\n\u003cli\u003eInform PI Web API users that annotation attachments should be \nretrieved through direct REST requests to PI Web API rather than \nrendering them in the browser interface.\u003c/li\u003e\n\u003cli\u003eAudit assigned privileges to ensure that only trusted users are given \"Annotate\" \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1020021.html\"\u003eaccess rights\u003c/a\u003e\u003c/li\u003e\u003cp\u003eFor additional information please refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.aveva.com/en/support-and-success/cyber-security-updates/\"\u003eAVEVA-2025-003\u003c/a\u003e.\n\n\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "AVEVA further recommends users follow general defensive measures:\n\n\n\n  *  Review and update the  file extensions allowlist https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1022248.html \n\n\n  *   for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, ...).\n\n  *  Consider implementing IT policies that would prevent users from \nsubverting/disabling content security policy browser protections.\n\n  *  Inform PI Web API users that annotation attachments should be \nretrieved through direct REST requests to PI Web API rather than \nrendering them in the browser interface.\n\n  *  Audit assigned privileges to ensure that only trusted users are given \"Annotate\"  access rights https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1020021.html \nFor additional information please refer to  AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ ."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2025-2745",
    "datePublished": "2025-06-12T19:42:27.001Z",
    "dateReserved": "2025-03-24T16:30:31.847Z",
    "dateUpdated": "2025-06-12T20:09:34.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-2745\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2025-06-12T20:15:21.040\",\"lastModified\":\"2025-06-16T12:32:18.840\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A cross-site scripting vulnerability exists in AVEVA\u00a0PI Web API version 2023 \\nSP1 and prior that, if exploited, could allow an authenticated attacker \\n(with privileges to create/update annotations or upload media files) to \\npersist arbitrary JavaScript code that will be executed by users who \\nwere socially engineered to disable content security policy protections \\nwhile rendering annotation attachments from within a web browser.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de cross-site scripting en AVEVA PI Web API versi\u00f3n 2023 SP1 y anteriores que, de ser explotada, podr\u00eda permitir que un atacante autenticado (con privilegios para crear o actualizar anotaciones o cargar archivos multimedia) persista c\u00f3digo JavaScript arbitrario que ser\u00e1 ejecutado por usuarios que fueron manipulados socialmente para deshabilitar las protecciones de la pol\u00edtica de seguridad de contenido mientras procesan archivos adjuntos de anotaciones desde un navegador web.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":4.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.3,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://www.aveva.com/en/support-and-success/cyber-security-updates/\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08\",\"source\":\"ics-cert@hq.dhs.gov\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-2745\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-12T20:09:20.915656Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-12T20:09:24.567Z\"}}], \"cna\": {\"title\": \"AVEVA PI Web API Cross-site Scripting\", \"source\": {\"advisory\": \"ICSA-25-162-08\", \"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"AVEVA reported this vulnerability to CISA.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 4.5, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"AVEVA\", \"product\": \"PI Web API\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2023 SP1\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"AVEVA recommends that organizations evaluate the impact of these \\nvulnerabilities based on their operational environment, architecture, \\nand product implementation. Users of affected product versions should \\napply security updates to mitigate the risk of exploit.\\n\\nFrom  OSISoft Customer Portal https://my.osisoft.com/ , search for \\\"PI Web API\\\" and select version 2023 SP1 Patch 1 or higher.\\u00a0\\n\\nFor additional information please refer to  AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAVEVA recommends that organizations evaluate the impact of these \\nvulnerabilities based on their operational environment, architecture, \\nand product implementation. Users of affected product versions should \\napply security updates to mitigate the risk of exploit.\u003c/p\u003e\u003cp\u003eFrom \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://my.osisoft.com/\\\"\u003eOSISoft Customer Portal\u003c/a\u003e, search for \\\"PI Web API\\\" and select version 2023 SP1 Patch 1 or higher.\u0026nbsp;\u003cbr\u003e\\nFor additional information please refer to \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.aveva.com/en/support-and-success/cyber-security-updates/\\\"\u003eAVEVA-2025-003\u003c/a\u003e.\\n\\n\u003cbr\u003e\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08\"}, {\"url\": \"https://www.aveva.com/en/support-and-success/cyber-security-updates/\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"AVEVA further recommends users follow general defensive measures:\\n\\n\\n\\n  *  Review and update the  file extensions allowlist https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1022248.html \\n\\n\\n  *   for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, ...).\\n\\n  *  Consider implementing IT policies that would prevent users from \\nsubverting/disabling content security policy browser protections.\\n\\n  *  Inform PI Web API users that annotation attachments should be \\nretrieved through direct REST requests to PI Web API rather than \\nrendering them in the browser interface.\\n\\n  *  Audit assigned privileges to ensure that only trusted users are given \\\"Annotate\\\"  access rights https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1020021.html \\nFor additional information please refer to  AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAVEVA further recommends users follow general defensive measures:\u003c/p\u003e\\n\u003cul\u003e\\n\u003cli\u003eReview and update the \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1022248.html\\\"\u003efile extensions allowlist\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cli\u003e for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, ...).\u003c/li\u003e\\n\u003cli\u003eConsider implementing IT policies that would prevent users from \\nsubverting/disabling content security policy browser protections.\u003c/li\u003e\\n\u003cli\u003eInform PI Web API users that annotation attachments should be \\nretrieved through direct REST requests to PI Web API rather than \\nrendering them in the browser interface.\u003c/li\u003e\\n\u003cli\u003eAudit assigned privileges to ensure that only trusted users are given \\\"Annotate\\\" \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1020021.html\\\"\u003eaccess rights\u003c/a\u003e\u003c/li\u003e\u003cp\u003eFor additional information please refer to \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.aveva.com/en/support-and-success/cyber-security-updates/\\\"\u003eAVEVA-2025-003\u003c/a\u003e.\\n\\n\u003cbr\u003e\u003c/p\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A cross-site scripting vulnerability exists in AVEVA\\u00a0PI Web API version 2023 \\nSP1 and prior that, if exploited, could allow an authenticated attacker \\n(with privileges to create/update annotations or upload media files) to \\npersist arbitrary JavaScript code that will be executed by users who \\nwere socially engineered to disable content security policy protections \\nwhile rendering annotation attachments from within a web browser.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A cross-site scripting vulnerability exists in AVEVA\u0026nbsp;PI Web API version 2023 \\nSP1 and prior that, if exploited, could allow an authenticated attacker \\n(with privileges to create/update annotations or upload media files) to \\npersist arbitrary JavaScript code that will be executed by users who \\nwere socially engineered to disable content security policy protections \\nwhile rendering annotation attachments from within a web browser.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2025-06-12T19:42:27.001Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-2745\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-12T20:09:34.976Z\", \"dateReserved\": \"2025-03-24T16:30:31.847Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2025-06-12T19:42:27.001Z\", \"assignerShortName\": \"icscert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.