CVE-2025-59428

{
  "id": "CVE-2025-59428",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-14T15:16:11.673",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element containing a link in the body field of an article. When an authenticated user clicks the malicious link, they are redirected to an attacker-controlled HTML page that executes a CSRF request against the api/v1/User endpoint. If the victim is prompted for and enters their credentials, an attacker-controlled account is created with privileges determined by the CSRF payload. This issue has been patched in version 9.1.9."
    },
    {
      "lang": "es",
      "value": "EspoCRM es una aplicación de gestión de relaciones con clientes de código abierto. En versiones anteriores a la 9.1.9, una vulnerabilidad permite la creación arbitraria de usuarios, incluyendo cuentas administrativas, a través de una combinación de inyección SVG almacenada y la falta de protección CSRF. Un atacante con permisos de edición de la Base de Conocimiento puede incrustar un elemento SVG malicioso que contiene un enlace en el campo de cuerpo de un artículo. Cuando un usuario autenticado hace clic en el enlace malicioso, es redirigido a una página HTML controlada por el atacante que ejecuta una solicitud CSRF contra el endpoint API/v1/User. Si se le solicita a la víctima sus credenciales y las introduce, se crea una cuenta controlada por el atacante con privilegios determinados por la carga útil CSRF. Este problema ha sido parcheado en la versión 9.1.9."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "espocrm",
          "product": "espocrm",
          "versions": [
            {
              "version": "< 9.1.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-14T16:03:30.276369Z",
          "id": "CVE-2025-59428",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "9.1.9",
              "matchCriteriaId": "8F85634C-E414-4BFA-9A30-987F87598B01"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}