CVE-2025-54128
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-07-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| psu | haxcms-nodejs | to 11.0.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists because the Content Security Policy (CSP) is disabled in the NodeJS version of HAX CMS (version 11.0.7 and below). CSP is a security feature that helps prevent cross-site scripting (XSS) attacks by restricting the sources from which content can be loaded. Disabling CSP means the application does not have this protection, making it vulnerable to XSS attacks where malicious scripts can be injected and executed in users' browsers.
How can this vulnerability impact me? :
The impact of this vulnerability is that attackers can exploit the disabled CSP to perform cross-site scripting (XSS) attacks. This can lead to unauthorized execution of malicious scripts in users' browsers, potentially resulting in theft of sensitive information, session hijacking, defacement of the website, or distribution of malware. Overall, it compromises the security and trustworthiness of the application.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the Content Security Policy (CSP) is disabled in the NodeJs HAX CMS application, specifically by inspecting the Helmet configuration in the app.js file. Look for the contentSecurityPolicy value being explicitly disabled. For example, you can use commands like `grep -i contentSecurityPolicy app.js` or `grep -i helmet app.js` to find the relevant configuration in the source code.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade the HAX CMS NodeJs application to version 11.0.8 or later, where the Content Security Policy is properly enabled. If upgrading is not immediately possible, manually enable the contentSecurityPolicy in the Helmet configuration within app.js to protect against cross-site scripting attacks.