CVE-2025-57539

{
  "id": "CVE-2025-57539",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-09T17:16:10.583",
  "lastModified": "2026-11-08T00:10:00.250",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenada en el campo de origen U2F de la configuración de Datacenter en Proxmox Virtual Environment (PVE) 8.4 permite a usuarios autenticados almacenar entradas maliciosas. La carga útil se renderiza de forma insegura en la interfaz de usuario web y se ejecuta cuando es vista por otros usuarios, lo que podría llevar al secuestro de sesión u otros ataques."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-10T13:24:15.895666Z",
          "id": "CVE-2025-57539",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:proxmox:virtual_environment:8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A4D382D-F04A-4D32-9A9C-20FD7F5E1713"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.youtube.com/watch?v=-wvkN-7oT5U",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}