CVE-2025-61431

{
  "id": "CVE-2025-61431",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-04T20:17:27.823",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the pHtmlSource parameter. A vendor fix was released on 2025-06-18."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de scripting entre sitios (XSS) reflejado en el endpoint /jsp/gsfr_feditorHTML.jsp de Zucchetti ZMaintenance Infinity e Infinity Zucchetti v4.1 y anteriores permite a los atacantes ejecutar Javascript arbitrario en el contexto del navegador de un usuario mediante la inyección de una carga útil diseñada en el parámetro pHtmlSource. Una corrección del proveedor fue lanzada el 18 de junio de 2025."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-04T21:13:03.843783Z",
          "id": "CVE-2025-61431",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zucchetti:infinity_zmaintenance:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "4.1",
              "matchCriteriaId": "2A0D0A29-E162-4A02-B2C4-3271E23C18ED"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:zucchetti:infinity_zucchetti:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "4.1",
              "matchCriteriaId": "10C340F5-D0BE-4577-A408-7CDF045D9F51"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gist.github.com/alex-xor/8651dbdd413e4fa7240b0ab1b1845d76",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.zucchetti.it/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}