CVE-2025-27802
BaseFortify
Publication date: 2025-07-28
Last updated on: 2025-11-03
Assigner: SEC Consult Vulnerability Lab
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| optimizely | episerver.cms.ui | 11.37.5 |
| optimizely | episerver.cms.core | 12.22.1 |
| optimizely | episerver.cms.core | 11.21.4 |
| optimizely | episerver.cms.ui | 11.37.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Episerver Content Management System (CMS) by Optimizely. It allows an authenticated attacker with at least the 'WebEditor' role to input malicious JavaScript code into certain text fields (RTE properties) in the CMS. When other users visit the previewed page containing this malicious input, the JavaScript code executes in their browsers.
How can this vulnerability impact me? :
The vulnerability can allow attackers with 'WebEditor' privileges to execute malicious JavaScript code in the browsers of users who view the affected pages. This can lead to unauthorized actions such as session hijacking, defacement, or theft of sensitive information from users interacting with the CMS preview pages.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Episerver CMS Core and CMS UI versions are updated to at least 11.21.4 and 11.37.5 respectively for version 11.X, or 12.22.1 and 11.37.3 respectively for version 12.X. Additionally, restrict the WebEditor role permissions to trusted users only, as exploitation requires this role. Consider sanitizing or validating input in RTE properties to prevent malicious JavaScript injection.