प्लेटफ़ॉर्म
other
घटक
starsea-mall
में ठीक किया गया
1.0.1
CVE-2025-2086 is a problematic cross-site scripting (XSS) vulnerability discovered in starsea-mall version 1.0. This flaw allows attackers to inject malicious scripts via manipulation of the redirectUrl parameter, potentially leading to session hijacking or defacement. The vulnerability affects versions 1.0 through 1.0, and a fix is available in version 1.0.1.
Successful exploitation of CVE-2025-2086 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to the theft of sensitive information, such as cookies and session tokens, enabling the attacker to impersonate the user. The attacker could also modify the content of the page, redirect users to malicious websites, or launch further attacks against the user's system. Given the nature of XSS, the impact can range from minor annoyance to complete compromise of user accounts and data.
This vulnerability has been publicly disclosed. While the CVSS score is LOW, the ease of exploitation and potential impact on user data warrant attention. No known active campaigns targeting this specific vulnerability have been reported as of the publication date, but the public availability of the exploit increases the risk of opportunistic attacks. The vulnerability was disclosed on 2025-03-07.
Starsea-mall deployments, particularly those running version 1.0, are at risk. Shared hosting environments where multiple users share the same instance of starsea-mall are especially vulnerable, as an attacker could potentially compromise other users' accounts through this XSS vulnerability.
disclosure
एक्सप्लॉइट स्थिति
EPSS
0.09% (25% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2025-2086 is to upgrade starsea-mall to version 1.0.1 or later, which contains the fix. If upgrading immediately is not possible, consider implementing input validation and sanitization on the redirectUrl parameter to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. Review and harden the application's security configuration to minimize the attack surface.
StarSea99 को एक पैच किए गए संस्करण में अपडेट करें जो XSS भेद्यता को ठीक करता है। अपडेट के बारे में अधिक जानकारी के लिए संस्करण नोट्स या विक्रेता की वेबसाइट देखें। एक अस्थायी उपाय के रूप में, इंजेक्शन स्क्रिप्ट को रोकने के लिए redirectUrl पैरामीटर में उपयोगकर्ता इनपुट को फ़िल्टर या एस्केप करें।
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2025-2086 is a cross-site scripting (XSS) vulnerability in starsea-mall versions 1.0–1.0, allowing attackers to inject malicious scripts via the redirectUrl parameter.
You are affected if you are running starsea-mall version 1.0. Upgrade to version 1.0.1 or later to mitigate the risk.
Upgrade starsea-mall to version 1.0.1 or later. Implement input validation and sanitization on the redirectUrl parameter as a temporary workaround.
No active campaigns targeting this specific vulnerability have been confirmed, but the public disclosure increases the risk of opportunistic attacks.
Refer to the starsea-mall project's official website or repository for the latest security advisories and updates.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।