youlaitech vue3-element-admin Notice index.vue cross site scripting

The XSS vulnerability in vue3-element-admin allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to various malicious actions, including stealing session cookies, redirecting users to phishing sites, defacing the application, and injecting malware. Given the public availability of an exploit, the risk of exploitation is significant, particularly for systems running vulnerable versions. The impact is amplified if the application handles sensitive data or is used in critical business processes.

Applications utilizing vue3-element-admin versions 3.0 through 3.4.0 are at risk. This includes projects that directly integrate the component or rely on it as a dependency. Shared hosting environments where multiple applications share the same codebase are particularly vulnerable, as a compromise of one application could potentially affect others.

• vue: Inspect the src/views/system/notice/index.vue file for suspicious JavaScript code or unusual DOM manipulation patterns. • generic web: Monitor access logs for requests containing unusual or obfuscated JavaScript payloads targeting the Notice Handler component. • generic web: Use browser developer tools to identify any unexpected JavaScript execution or DOM modifications on the Notice Handler page. • generic web: Check response headers for the presence of Content Security Policy (CSP) directives that could mitigate XSS attacks.

1. 2025-12-31Disclosure

   disclosure

1. आरक्षित2025-12-30
2. प्रकाशित2025-12-31
3. संशोधित2026-01-02
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-15372 is to upgrade to version 3.4.1 or later of vue3-element-admin. If an immediate upgrade is not feasible, consider implementing input validation and output encoding on the src/views/system/notice/index.vue component to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and update security rules to reflect the latest threat intelligence.