CVE-2025-0971: XSS in Movidesk Profile Editing

Successful exploitation of CVE-2025-0971 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious outcomes, including session hijacking, credential theft, and defacement of the Movidesk interface. The attacker could potentially gain access to sensitive user data or perform actions on behalf of the compromised user. Given the remote nature of the exploit, any user accessing the /Account/EditProfile endpoint is potentially at risk. The impact is amplified if Movidesk is used to manage sensitive data or control critical systems.

1. Reserved2025-02-02
2. Published2025-02-02
3. Modified2025-02-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-0971 is to immediately upgrade Movidesk to version 25.01.22.245a473c54 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the username parameter within the /Account/EditProfile endpoint to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Monitor access logs for suspicious activity related to the /Account/EditProfile endpoint, looking for unusual characters or patterns in the username parameter.