CVE-2025-40892: Stored Cross-Site Scripting (XSS) in Reports in Guardian/CMC before 25.5.0
A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the XSS executes in their browser context, allowing the attacker to perform unauthorized actions as the victim, such as modify application data, disrupt application availability, and access limited sensitive information.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40892?
CVE-2025-40892 is classified as a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-40892?
To fix CVE-2025-40892, ensure proper validation and sanitization of input parameters in the Reports functionality.
Who is affected by CVE-2025-40892?
CVE-2025-40892 affects authenticated users with report privileges in Guardian/CMC versions prior to 25.5.0.
What types of attacks can be executed using CVE-2025-40892?
CVE-2025-40892 can be exploited to execute malicious JavaScript payloads leading to potential theft of session tokens and user data.
Is CVE-2025-40892 being actively exploited?
There is currently no public information indicating active exploitation of CVE-2025-40892, but it is recommended to apply mitigations promptly.