SohuTV CacheCloud TaskController.java taskQueueList cross site scripting

The XSS vulnerability in SohuTV CacheCloud allows an attacker to inject arbitrary JavaScript code into web pages viewed by other users. This can be leveraged to steal session cookies, redirect users to malicious websites, or deface the application. The impact is amplified if the CacheCloud application is used to manage sensitive data or control critical systems. While the CVSS score is LOW, the potential for user compromise and data theft remains a significant concern, especially in environments with limited security controls. The remote nature of the vulnerability means an attacker does not need local access to exploit it.

Organizations using SohuTV CacheCloud versions 3.0 through 3.2.0 are at risk, particularly those with publicly accessible instances or those handling sensitive user data. Shared hosting environments where CacheCloud is deployed could be especially vulnerable due to the potential for cross-tenant exploitation.

• java / server:

find /opt/sohutv/cachecloud/ -name "TaskController.java"

• java / server:

grep -r "taskQueueList" /opt/sohutv/cachecloud/

• generic web:

curl -I http://your-cachecloud-server/taskQueueList

• generic web:

grep -A 10 "taskQueueList" /var/log/apache2/access.log

1. 2025-12-29Disclosure

   disclosure

1. 已保留2025-12-28
2. 发布日期2025-12-29
3. 修改日期2025-12-30
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-15202 is to upgrade to SohuTV CacheCloud version 3.2.1 or later, which contains the necessary fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on the taskQueueList endpoint to sanitize user-supplied data. Web application firewalls (WAFs) can also be configured to detect and block XSS attempts targeting this specific function. Regularly review and update security policies to prevent similar vulnerabilities in the future.