CVE-2025-63498: XSS
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sogoto a version that resolves this vulnerability.Fixed in 5.8.0-2+deb12u1 - Upgrade
Upgrade
debian/sogoto a version that resolves this vulnerability.Fixed in 5.12.1-3+deb13u1 - Upgrade
Upgrade
debian/sogoto a version that resolves this vulnerability.Fixed in 5.8.0-2+deb12u3Fixed in 5.12.1-3+deb13u2Fixed in 5.12.1-3+deb13u3Fixed in 5.12.12-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63498?
CVE-2025-63498 is classified as a moderate severity Cross Site Scripting (XSS) vulnerability.
How do I fix CVE-2025-63498?
To fix CVE-2025-63498, validate and sanitize the input for the "userName" parameter to mitigate XSS risks.
Which software versions are affected by CVE-2025-63498?
CVE-2025-63498 affects Alinto SOGo version 5.12.3.
What type of vulnerability is CVE-2025-63498?
CVE-2025-63498 is a Cross Site Scripting (XSS) vulnerability that can allow attackers to inject malicious scripts.
What impact does CVE-2025-63498 have on users?
CVE-2025-63498 can potentially allow an attacker to execute scripts in a user's browser, compromising their session and privacy.