CVE-2025-41054
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-04
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apprain | apprain | 4.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41054 is a stored authenticated Cross-Site Scripting (XSS) vulnerability in appRain CMF version 4.0.5. It occurs because the application does not properly validate user input in the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters at the endpoint /apprain/developer/addons/update/cycle. An authenticated attacker can inject malicious scripts that are stored and later executed in the context of the application, potentially affecting users who view the stored data. [1]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to inject malicious scripts that execute in the context of the application. This can lead to session hijacking, privilege escalation, or other client-side attacks. Such attacks may compromise user accounts, steal sensitive information, or allow attackers to perform unauthorized actions within the application. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves verifying if the appRain CMF version 4.0.5 is running and testing the endpoint `/apprain/developer/addons/update/cycle` for stored authenticated XSS via the parameters `data[Addon][layouts]` and `data[Addon][layouts_except]`. Since the vulnerability requires authenticated access, detection commands should include authenticated requests injecting benign XSS payloads into these parameters and observing if the payload is stored and executed. For example, using curl with authentication tokens to POST data with script tags in these parameters and then checking the response or subsequent page rendering for script execution. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the affected endpoints to only trusted authenticated users, applying strict input validation and sanitization on the parameters `data[Addon][layouts]` and `data[Addon][layouts_except]`, and monitoring for suspicious activity. Since no patches or solutions have been reported yet, consider disabling or limiting the use of the vulnerable functionality until a fix is available. Additionally, educate users about the risks of XSS and ensure that authentication credentials are protected to prevent exploitation. [1]