CVE-2025-40901: HTML injection in Credentials Manager in Guardian/CMC before 26.1.0
A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious identity containing HTML tags. When a victim attempts to delete the affected identity, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40901?
CVE-2025-40901 is classified as a high-severity vulnerability due to its potential for stored HTML injection by an authenticated user.
How do I fix CVE-2025-40901?
To fix CVE-2025-40901, users should upgrade the Guardian/CMC software to version 26.1.0 or later.
Who is affected by CVE-2025-40901?
CVE-2025-40901 affects users of Guardian/CMC versions prior to 26.1.0 with administrative privileges.
What is the impact of CVE-2025-40901?
The impact of CVE-2025-40901 allows an authenticated user to execute arbitrary HTML code, potentially compromising the application's integrity.
Is CVE-2025-40901 easy to exploit?
CVE-2025-40901 can be considered relatively easy to exploit for authenticated users, which increases the risk of attack.