Cross Site Scripting in Arket Globe Document Intelligence 5.0.0.559

Mitigation Strategies

The immediate mitigation step is to update Globe Document Intelligence to version 5.1.0.575 or later, where the vulnerability has been patched.

Until the update can be applied, restrict access to the document creation features to trusted users only and monitor for suspicious activity involving script injection.

Additionally, consider implementing input sanitization or filtering at the application or web server level to block JavaScript code in user inputs.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to inject JavaScript code into the "Title" field of a new document in Globe Document Intelligence version 5.0.0.559 and then observing if the script executes when viewing the "Task in progress / Recent" page.

A simple test command could be to create a document with a payload such as <script>alert(1)</script> in the Title field and then check if an alert box appears when the page is viewed by another user.

Network detection might involve monitoring HTTP requests for suspicious input containing JavaScript code in the document creation fields or scanning stored documents for embedded scripts.

Useful 0 Not Useful 0

Executive Summary

CVE-2025-65640 is a Stored Cross-Site Scripting (XSS) vulnerability in Arket Globe Document Intelligence version 5.0.0.559. It occurs because the application does not properly sanitize user input in text fields when creating a new document, specifically in the "Title" field.

An authenticated attacker can inject malicious JavaScript code into these fields, which is then stored on the server. When other users view affected pages like "Task in Progress / Recent," the injected script executes in their browsers.

This allows the attacker to run arbitrary JavaScript in the context of other users' browsers.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to serious security impacts such as session hijacking or account takeover if exploited.

An attacker could use the injected JavaScript to steal session cookies or perform actions on behalf of other users, including administrators.

This compromises user accounts and potentially the integrity and confidentiality of the system.

Useful 0 Not Useful 0

Compliance Impact

The Cross Site Scripting (XSS) vulnerability in Arket Globe Document Intelligence allows an attacker to execute arbitrary JavaScript in other users' browsers, potentially leading to session hijacking or account takeover.

Such unauthorized access and data exposure could compromise the confidentiality and integrity of personal or sensitive data managed by the application.

This risk may negatively impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal data against unauthorized access and ensuring secure processing.

Therefore, failure to address this vulnerability could lead to violations of these standards due to potential data breaches or unauthorized data exposure.

Useful 0 Not Useful 0