CVE-2025-53839
BaseFortify
Publication date: 2025-07-15
Last updated on: 2025-07-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dracoon | branding_service | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) issue in the DRACOON Branding Service prior to version 2.10.0. It occurs because administrative user input is not properly neutralized, allowing malicious HTML code to be injected into the workflow for newly onboarded users. This can lead to limited impacts on confidentiality and integrity. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to inject malicious HTML code into the onboarding workflow, potentially compromising the confidentiality and integrity of information seen by new users. However, it does not affect system availability. Exploitation requires network access, high privileges, and user interaction. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves verifying the version of the DRACOON Branding Service in use to ensure it is 2.10.0 or later. Since the vulnerability is related to cross-site scripting via administrative input, monitoring for unusual HTML or script injections in the onboarding workflow could help. However, no specific detection commands or network scanning techniques are provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The vulnerability was fixed in DRACOON Branding Service version 2.10.0, which has been rolled out to the DRACOON service. DRACOON customers do not need to take any action. Immediate mitigation involves ensuring the service is updated to version 2.10.0 or later. If running an on-premises instance, upgrade to the fixed version to mitigate the vulnerability. [1]