CVE-2025-11085
BaseFortify
Publication date: 2025-11-11
Last updated on: 2025-11-11
Assigner: Rockwell Automation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rockwellautomation | factorytalk_datamosaix | 8.01 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Persistent Cross-Site Scripting (XSS) issue in DataMosaix™ Private Cloud versions 7.11 and 8.00. It allows attackers to inject malicious JavaScript code that executes persistently within the application. This can lead to account takeover, credential theft, or redirecting users to malicious websites. [1]
How can this vulnerability impact me? :
The impact includes the potential for attackers to take over user accounts, steal credentials, or redirect users to malicious websites, which can compromise user security and trust in the system. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade FactoryTalk® DataMosaix™ Private Cloud to version 8.01 or later, where the Persistent XSS vulnerability is fixed. If you cannot upgrade immediately, follow Rockwell Automation's security best practices to secure your environment, although no specific workaround is provided. [1]