CVE-2025-1987

A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data.

CVSS

No CVSS.

References

Link	Resource
https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls

Configurations

No configuration.

History

23 Jun 2025, 20:16

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) en la gestión por parte de Psono-Client de las entradas de la bóveda de tipo "website_password" y "bookmark", utilizadas en Bitdefender SecurePass. El cliente no depura correctamente el campo URL de estas entradas. Como resultado, un atacante puede manipular una entrada de bóveda maliciosa (o engañar al usuario para que la cree o importe) con una URL javascript:URL. Cuando el usuario interactúa con esta entrada (por ejemplo, al hacer clic o abrirla), la aplicación ejecuta el JavaScript malicioso en el contexto de la bóveda de Psono. Esto permite a un atacante ejecutar código arbitrario en el navegador de la víctima, lo que podría otorgarle acceso a la bóveda de contraseñas y a datos confidenciales del usuario.

21 Jun 2025, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-21 22:15

Updated : 2025-06-23 20:16

NVD link : CVE-2025-1987

Mitre link : CVE-2025-1987

CVE.ORG link : CVE-2025-1987

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-1987", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cve-requests@bitdefender.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-21T22:15:21.510", "references": [{"url": "https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls", "source": "cve-requests@bitdefender.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cve-requests@bitdefender.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS)\u00a0vulnerability has been identified in Psono-Client\u2019s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim\u2019s browser, potentially giving them access to the user\u2019s password vault and sensitive data."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) en la gesti\u00f3n por parte de Psono-Client de las entradas de la b\u00f3veda de tipo \"website_password\" y \"bookmark\", utilizadas en Bitdefender SecurePass. El cliente no depura correctamente el campo URL de estas entradas. Como resultado, un atacante puede manipular una entrada de b\u00f3veda maliciosa (o enga\u00f1ar al usuario para que la cree o importe) con una URL javascript:URL. Cuando el usuario interact\u00faa con esta entrada (por ejemplo, al hacer clic o abrirla), la aplicaci\u00f3n ejecuta el JavaScript malicioso en el contexto de la b\u00f3veda de Psono. Esto permite a un atacante ejecutar c\u00f3digo arbitrario en el navegador de la v\u00edctima, lo que podr\u00eda otorgarle acceso a la b\u00f3veda de contrase\u00f1as y a datos confidenciales del usuario."}], "lastModified": "2025-06-23T20:16:21.633", "sourceIdentifier": "cve-requests@bitdefender.com"}