CVE-2025-26621CWE-94

OpenCTI vulnerable to Denial of Service through web hook

High · published May 19, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype pollution, making the node js server running the OpenCTI frontend become unavailable. Version 6.5.2 fixes the issue.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-05-19T16:01Z
EPSS history
Timeline
  • 19 MAY 16:01Z
    OpenCTI vulnerable to Denial of Service through web hook
    cvelistv5