CVE-2025-24017

{"id": "CVE-2025-24017", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-01-21T16:15:15.087", "references": [{"url": "https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wphc-5f2j-jhvg", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue."}, {"lang": "es", "value": "YesWiki es una wiki sistema escrita en PHP. Las versiones hasta incluida 4.4.5 son vulnerables a que cualquier usuario final manipule un XSS basado en DOM en todas las p\u00e1ginas de YesWiki que se active cuando un usuario haga clic en un enlace malicioso. La vulnerabilidad hace uso de la funci\u00f3n de b\u00fasqueda por etiqueta. Cuando una etiqueta no existe, la etiqueta se refleja en la p\u00e1gina y no se desinfecta correctamente en el lado del servidor, lo que permite a un usuario malicioso generar un enlace que activar\u00e1 un XSS en el lado del cliente cuando se haga clic en \u00e9l. Esta vulnerabilidad permite a cualquier usuario generar un enlace malicioso que activar\u00e1 una apropiaci\u00f3n de cuenta cuando se haga clic en \u00e9l, lo que permite a un usuario robar otras cuentas, modificar p\u00e1ginas, comentarios, permisos, extraer datos de usuario (correos electr\u00f3nicos), lo que afecta la integridad, disponibilidad y confidencialidad de una instancia de YesWiki. La versi\u00f3n 4.5.0 contiene un parche para el problema."}], "lastModified": "2025-05-09T14:05:15.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73A9706C-A5C2-4B1E-91E9-08C65D4B41C9", "versionEndExcluding": "4.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}