CVE-2025-66823
HTML Injection in TrueConf Server Conference Description Allows XSS
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trueconf | server | 5.5.2.10813 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the conference description field in TrueConf server 5.5.2.10813 contains injected HTML code. One approach is to review the Create/Edit conference descriptions for suspicious HTML tags. Additionally, monitoring HTTP traffic to the conference info page ([conference url]/info) for unexpected HTML payloads can help identify exploitation attempts. Specific commands depend on your environment, but for example, using curl or wget to fetch the conference info page and grep to search for suspicious HTML tags can be useful, e.g., `curl -s http://[conference url]/info | grep '<script\|<iframe\|<img'`.
Can you explain this vulnerability to me?
This vulnerability is an HTML Injection in TrueConf server version 5.5.2.10813. It occurs in the conference description field within the Create/Edit conference functionality, allowing an attacker to inject arbitrary HTML code. The injected payload is executed when a user opens the Conference Info page, potentially leading to malicious effects.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to inject malicious HTML code that executes when users view the Conference Info page. This can lead to various attacks such as cross-site scripting (XSS), session hijacking, or defacement, potentially compromising user data or the integrity of the application.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include sanitizing or validating the conference description input to prevent HTML injection, restricting user permissions to limit who can create or edit conferences, and advising users not to open suspicious conference info pages. Applying any available patches or updates from TrueConf for this vulnerability is also recommended once available.