CVE-2025-7380
BaseFortify
Publication date: 2025-07-14
Last updated on: 2025-07-15
Assigner: ASUSTOR, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| asustor | adm | 4.1.0 |
| asustor | adm | 4.3.3.rh61 |
| asustor | adm | 5.0.0.rin1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-7380 is a stored Cross-Site Scripting (XSS) vulnerability in the Access Control component of ASUSTOR Data Master (ADM). It allows an attacker to inject malicious JavaScript code into the folder name field when creating a new shared folder. These scripts are not properly sanitized and will execute when the folder name is displayed in the user interface, enabling the attacker to run arbitrary JavaScript in another user's session context, potentially stealing session cookies or sensitive data. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute arbitrary JavaScript code within your user session. This can lead to theft of session cookies or other sensitive information, potentially compromising your account or data confidentiality. The attack can be performed remotely with low complexity but requires some user interaction. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking for shared folders with folder names containing suspicious or malicious JavaScript code injections. Since the vulnerability is a stored XSS in the folder name field, you can inspect the folder names via the ADM user interface or by querying the system for shared folder names that include script tags or JavaScript code. There are no specific commands provided in the resources, but a general approach would be to list shared folders and look for suspicious characters such as <script> tags. For example, using ADM's command line or API to list shared folders and grep for script tags could help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding creating or accepting shared folder names that contain suspicious or potentially malicious scripts. Since no fixed releases are available as of the advisory date, administrators should limit user privileges to prevent unauthorized folder creation or modification, and educate users to avoid interacting with suspicious folder names. Monitoring and restricting access to the Access Control component of ADM can also reduce risk. Applying any available security best practices from ASUSTOR and monitoring for updates or patches is recommended. [1]