CVE-2025-22388CWE-79

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0

Medium · published January 4, 2025

CVSS v3.1
5.7
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00373 · 30.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-01-04T00:00Z
EPSS history
Timeline
  • 04 JAN 00:00Z
    An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0
    cvelistv5