CVE-2025-2211: XSS in springboot-manager 3.0

Successful exploitation of CVE-2025-2211 allows an attacker to inject arbitrary JavaScript code into the springboot-manager application. This code can then be executed in the context of a victim's browser when they access a vulnerable page. The attacker could steal session cookies, redirect users to malicious websites, or deface the application. The vulnerability's remote accessibility significantly broadens the potential attack surface, as it doesn't require local access to the system. The lack of vendor response raises concerns about the overall security posture of the application and potential unaddressed vulnerabilities.

1. Reserved2025-03-11
2. Published2025-03-11
3. Modified2025-03-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-2211 is to upgrade to springboot-manager version 3.0.1 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing input validation and sanitization on the /sysDictDetail/add endpoint to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update input validation routines to prevent similar vulnerabilities from arising in the future. After upgrade, confirm by testing the /sysDictDetail/add endpoint with various input strings to ensure no XSS payloads are executed.