CVE-2025-56313

{
  "id": "CVE-2025-56313",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-30T18:15:32.667",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). This allows remote attackers to execute arbitrary JavaScript in a user's web browser by including a malicious payload in the \"code\" URL parameter. When an authenticated admin user accesses the study's URL, the malicious script gets interpreted and executes within their browser, which can lead to unauthorized actions, account compromise, and privilege escalation."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting (XSS) reflejada fue descubierta en el endpoint /publix/run de JATOS 3.7.1 hasta 3.9.6 (inclusive). Esto permite a atacantes remotos ejecutar JavaScript arbitrario en el navegador web de un usuario al incluir una carga útil maliciosa en el parámetro URL ’code’. Cuando un usuario administrador autenticado accede a la URL del estudio, el script malicioso es interpretado y ejecutado dentro de su navegador, lo que puede llevar a acciones no autorizadas, compromiso de cuenta y escalada de privilegios."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-30T18:19:07.774950Z",
          "id": "CVE-2025-56313",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/JATOS/JATOS",
      "source": "[email protected]"
    },
    {
      "url": "https://medium.com/@ruizramisdaniel/cve-2025-56313-jatos-v3-9-6-reflected-xss-in-study-links-af1305ae09d0",
      "source": "[email protected]"
    },
    {
      "url": "https://medium.com/@ruizramisdaniel/cve-2025-56313-jatos-v3-9-6-reflected-xss-in-study-links-af1305ae09d0",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}