CVE-2025-30191

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2025-10-31

Last updated on: 2025-11-04

Assigner: Open-Xchange

Description

Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensitive information to a third party which would enable further threats. Attribute values containing HTML fragments are now denied by the sanitization procedure. No publicly available exploits are known

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-31

Last Modified

2025-11-04

Generated

2026-07-06

AI Q&A

2025-10-31

EPSS Evaluated

2026-07-05

NVD

CVE-2025-30191

EUVD

EUVD-2025-37316

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

Executive Summary

This vulnerability involves malicious content in E-Mail that can be used to perform a redressing attack. It tricks users into performing unintended actions or providing sensitive information to a third party, which can lead to further threats. The issue is mitigated by denying attribute values containing HTML fragments through sanitization.

Impact Analysis

The vulnerability can lead to users being tricked into unintended actions or disclosing sensitive information to attackers, potentially enabling further malicious activities against the user or system.

Mitigation Strategies

To mitigate this vulnerability, ensure that attribute values containing HTML fragments are properly sanitized and denied by your email handling or web application sanitization procedures. Educate users to be cautious with email content to avoid being tricked into unintended actions or providing sensitive information. Since no publicly available exploits are known, maintaining updated sanitization practices is key.

Hi! I’m here to help you understand CVE-2025-30191. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70