{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-25062", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-05-09T12:03:34.762Z", "dateReserved": "2025-02-03T00:00:00.000Z", "datePublished": "2025-02-03T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "backdrop", "vendor": "backdropcms", "versions": [{"lessThan": "1.28.5", "status": "affected", "version": "1.28.0", "versionType": "semver"}, {"lessThan": "1.29.3", "status": "affected", "version": "1.29.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-05-06T17:21:48.887Z"}, "references": [{"url": "https://backdropcms.org/security/backdrop-sa-core-2025-001"}, {"url": "https://medium.com/@rudranshsinghrajpurohit/cve-2025-25062-stored-cross-site-scripting-xss-in-backdrop-cms-5073df76612b"}, {"url": "https://www.getastra.com/blog/vulnerability/cve-2025-25062stored-cross-site-scripting-xss-in-backdrop-cms-v1-28-2/"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.28.0", "versionEndExcluding": "1.28.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.29.0", "versionEndExcluding": "1.29.3"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-09T12:03:26.029242Z", "id": "CVE-2025-25062", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-09T12:03:34.762Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-25062", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-09T12:03:26.029242Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T20:40:44.518Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "backdropcms", "product": "backdrop", "versions": [{"status": "affected", "version": "1.28.0", "lessThan": "1.28.5", "versionType": "semver"}, {"status": "affected", "version": "1.29.0", "lessThan": "1.29.3", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://backdropcms.org/security/backdrop-sa-core-2025-001"}, {"url": "https://medium.com/@rudranshsinghrajpurohit/cve-2025-25062-stored-cross-site-scripting-xss-in-backdrop-cms-5073df76612b"}, {"url": "https://www.getastra.com/blog/vulnerability/cve-2025-25062stored-cross-site-scripting-xss-in-backdrop-cms-v1-28-2/"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.28.5", "versionStartIncluding": "1.28.0"}, {"criteria": "cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.29.3", "versionStartIncluding": "1.29.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-05-06T17:21:48.887Z"}}}, "cveMetadata": {"cveId": "CVE-2025-25062", "state": "PUBLISHED", "dateUpdated": "2025-05-09T12:03:34.762Z", "dateReserved": "2025-02-03T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-02-03T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "39EE496A-3364-4130-9E8F-D775C0F5E905", "versionEndExcluding": "1.28.5", "versionStartIncluding": "1.28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:backdropcms:backdrop_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB62109D-7E44-4BDF-8508-FA491815FB75", "versionEndExcluding": "1.29.3", "versionStartIncluding": "1.29.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module."}, {"lang": "es", "value": "Se descubri\u00f3 un problema de XSS en Background CMS 1.28.x anterior a 1.28.5 y 1.29.x anterior a 1.29.3. No a\u00edsla lo suficiente el contenido de texto largo cuando se utiliza el editor de texto enriquecido CKEditor 5. Esto permite que un atacante potencial manipule HTML y JavaScript especializados que pueden ejecutarse cuando un administrador intenta editar un fragmento de contenido. Esta vulnerabilidad se mitiga por el hecho de que un atacante debe tener la capacidad de crear contenido de texto largo (por ejemplo, a trav\u00e9s de los formularios de nodos o comentarios) y un administrador debe editar (no ver) el contenido que contiene el contenido malicioso. Este problema solo existe cuando se utiliza el m\u00f3dulo CKEditor 5."}], "id": "CVE-2025-25062", "lastModified": "2026-01-23T18:46:32.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2025-02-03T04:15:09.587", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://backdropcms.org/security/backdrop-sa-core-2025-001"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "Exploit"], "url": "https://medium.com/@rudranshsinghrajpurohit/cve-2025-25062-stored-cross-site-scripting-xss-in-backdrop-cms-5073df76612b"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "Exploit"], "url": "https://www.getastra.com/blog/vulnerability/cve-2025-25062stored-cross-site-scripting-xss-in-backdrop-cms-v1-28-2/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{}