CVE-2025-11884: Cross-site Scripting vulnerability discovered in OpenText™ Universal Discovery and CMDB

Published Nov 19, 2025

Updated

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in opentext uCMDB allows Stored XSS. The vulnerability could allow an attacker has high level access to UCMDB to create or update data with malicious scripts

This issue affects uCMDB: 24.4.

Affected Software

1 affected component

OpenText UCMDB

Remediation

Information

https://portal.microfocus.com/s/article/KM000043674?language=en_US

Event History

Nov 19, 2025

CVE Published

via MITRE·09:13 PM

Data Sourced

via MITRE·09:13 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-11884?

CVE-2025-11884 has a high severity rating due to its potential for stored cross-site scripting attacks.

How do I fix CVE-2025-11884?

To fix CVE-2025-11884, ensure that all user inputs in OpenText uCMDB are properly validated and sanitized to prevent script injection.

Who is affected by CVE-2025-11884?

CVE-2025-11884 affects users of OpenText uCMDB that have high-level access to create or update data.

What type of vulnerability is CVE-2025-11884?

CVE-2025-11884 is classified as a Cross-site Scripting (XSS) vulnerability.

What can an attacker do with CVE-2025-11884?

An attacker could exploit CVE-2025-11884 to inject malicious scripts that can execute in the context of a user's session, compromising user data.