CVE-2025-11952
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-31
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oct8ne | chatbot | 2.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11952 is a Stored Cross-Site Scripting (XSS) vulnerability in Oct8ne Chatbot version 2.3. It allows an attacker to inject malicious JavaScript code by creating a transcript that is sent via email through the '/Records/SendSummaryMail' endpoint. When the victim opens the email, the malicious script executes in their browser, potentially compromising their session and enabling unauthorized actions. [1]
How can this vulnerability impact me? :
This vulnerability can lead to theft of sensitive user data such as session cookies and allow attackers to perform unauthorized actions on behalf of the user. This can compromise user accounts and data integrity, potentially leading to further exploitation or data breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for suspicious activity targeting the '/Records/SendSummaryMail' endpoint, such as unusual POST requests containing JavaScript payloads in transcript creation. Additionally, inspecting email contents for injected scripts in summary mails sent by the chatbot can help identify exploitation attempts. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Oct8ne Chatbot to the latest version where the vulnerability has been fixed. Additionally, reviewing and restricting access to the '/Records/SendSummaryMail' endpoint and educating users to be cautious when opening emails containing chatbot transcripts can reduce risk. [1]