CVE-2025-1145 - Vulnerability Details - OpenCVE

NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00391.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-8418-40958-2.html
https://www.twcert.org.tw/tw/cp-132-8417-ea1ea-1.html

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00041}`	epss `{'score': 0.00053}`

Tue, 11 Feb 2025 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 11 Feb 2025 03:45:00 +0000

Type	Values Removed	Values Added
Description		NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.
Title		NetVision Information ISOinsight - Reflected Cross-site Scripting
Weaknesses		CWE-79
References		https://www.twcert.org.tw/en/cp-139-8418-40958-2.html https://www.twcert.org.tw/tw/cp-132-8417-ea1ea-1.html
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2025-02-11T03:28:31.981Z

Updated: 2025-02-18T17:54:32.362Z

Reserved: 2025-02-10T01:51:09.202Z

Link: CVE-2025-1145

Vulnrichment

Updated: 2025-02-11T05:21:25.647Z

NVD

Status : Deferred

Published: 2025-02-11T04:15:08.480

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-1145

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1145", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2025-02-10T01:51:09.202Z", "datePublished": "2025-02-11T03:28:31.981Z", "dateUpdated": "2025-02-18T17:54:32.362Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ISOinsight", "vendor": "NetVision Information", "versions": [{"lessThan": "2.9.0.241231", "status": "affected", "version": "2.9.0.*", "versionType": "custom"}, {"lessThan": "3.0.0.241231", "status": "affected", "version": "3.0.0.*", "versionType": "custom"}]}], "datePublic": "2025-02-11T03:25:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques."}], "value": "NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques."}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2025-02-11T03:28:31.981Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-8417-ea1ea-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-8418-40958-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "For v2.9.0.x, please update to version 2.9.0.241231 or later.<br>For v3.0.0.x, please update to version 3.0.0.241231 or later.<br>"}], "value": "For v2.9.0.x, please update to version 2.9.0.241231 or later.\nFor v3.0.0.x, please update to version 3.0.0.241231 or later."}], "source": {"advisory": "TVN-202502003", "discovery": "EXTERNAL"}, "title": "NetVision Information ISOinsight - Reflected Cross-site Scripting", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-11T05:20:20.105920Z", "id": "CVE-2025-1145", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T17:54:32.362Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1145", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-11T05:20:20.105920Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T05:21:25.647Z"}}], "cna": {"title": "NetVision Information ISOinsight - Reflected Cross-site Scripting", "source": {"advisory": "TVN-202502003", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NetVision Information", "product": "ISOinsight", "versions": [{"status": "affected", "version": "2.9.0.*", "lessThan": "2.9.0.241231", "versionType": "custom"}, {"status": "affected", "version": "3.0.0.*", "lessThan": "3.0.0.241231", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "For v2.9.0.x, please update to version 2.9.0.241231 or later.\nFor v3.0.0.x, please update to version 3.0.0.241231 or later.", "supportingMedia": [{"type": "text/html", "value": "For v2.9.0.x, please update to version 2.9.0.241231 or later.<br>For v3.0.0.x, please update to version 3.0.0.241231 or later.<br>", "base64": false}]}], "datePublic": "2025-02-11T03:25:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-8417-ea1ea-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-8418-40958-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.", "supportingMedia": [{"type": "text/html", "value": "NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2025-02-11T03:28:31.981Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1145", "state": "PUBLISHED", "dateUpdated": "2025-02-18T17:54:32.362Z", "dateReserved": "2025-02-10T01:51:09.202Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2025-02-11T03:28:31.981Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}