CVE-2025-34281

{
  "id": "CVE-2025-34281",
  "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
  "published": "2025-10-17T19:15:37.197",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the \"Image Gallery\", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions."
    },
    {
      "lang": "es",
      "value": "ThingsBoard en versiones anteriores a v4.2.1 permite a un usuario autenticado cargar imágenes SVG maliciosas a través de la 'Galería de imágenes', lo que lleva a una vulnerabilidad de Cross-Site Scripting Almacenado (XSS). El exploit puede activarse cuando cualquier usuario accede al endpoint de la API pública de las imágenes SVG maliciosas, o si las imágenes maliciosas se incrustan en un elemento 'iframe', durante la creación de un widget, desplegado en cualquier página de la plataforma (p. ej., paneles de control), y se accede a ellas durante las operaciones normales. La vulnerabilidad reside en el 'ImageController', que no restringe la ejecución de código JavaScript cuando una imagen es cargada por el navegador del usuario. Esta vulnerabilidad puede llevar a la ejecución de código malicioso en el contexto de las sesiones de otros usuarios, comprometiendo potencialmente sus cuentas y permitiendo acciones no autorizadas."
    }
  ],
  "affected": [
    {
      "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
      "affectedData": [
        {
          "vendor": "thingsboard",
          "product": "thingsboard",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/thingsboard/thingsboard",
          "versions": [
            {
              "version": "0",
              "lessThan": "4.2.1",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-17T18:58:41.437131Z",
          "id": "CVE-2025-34281",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:thingsboard:thingsboard:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.2.1",
              "matchCriteriaId": "DCE4C513-C695-4227-B5E7-BBD2EC014DF8"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://advisory.checkmarx.net/advisory/CVE-2025-34281/",
      "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"
    },
    {
      "url": "https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03",
      "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"
    },
    {
      "url": "https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1",
      "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
      "tags": [
        "Release Notes"
      ]
    }
  ]
}