CVE-2025-30158

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to post iframe elements inside forum topics/comments/feed with no restriction on the iframe's width and height attributes. This allows an authenticated attacker to perform a UI-based denial of service (DoS) by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This issue has been patched in version 2.2.0.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/NamelessMC/Nameless/commit/caa42a975338a13fbc1658e8c440108f16135643	Patch
https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0	Release Notes
https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2prx-rgr7-hq5f	Exploit Vendor Advisory
https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2prx-rgr7-hq5f	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-18 16:15

Updated : 2025-05-13 15:40

NVD link : CVE-2025-30158

Mitre link : CVE-2025-30158

CVE.ORG link : CVE-2025-30158

JSON object : View

Products Affected

namelessmc

nameless

CWE

CWE-400

Uncontrolled Resource Consumption

NVD-CWE-noinfo

{"id": "CVE-2025-30158", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2025-04-18T16:15:22.443", "references": [{"url": "https://github.com/NamelessMC/Nameless/commit/caa42a975338a13fbc1658e8c440108f16135643", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2prx-rgr7-hq5f", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2prx-rgr7-hq5f", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to post iframe elements inside forum topics/comments/feed with no restriction on the iframe's width and height attributes. This allows an authenticated attacker to perform a UI-based denial of service (DoS) by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This issue has been patched in version 2.2.0."}, {"lang": "es", "value": "NamelessMC es un software web gratuito, f\u00e1cil de usar y potente para servidores de Minecraft. En la versi\u00f3n 2.1.4 y anteriores, el foro permite a los usuarios publicar elementos iframe dentro de los temas, comentarios y feeds del foro sin restricciones en los atributos de ancho y alto del iframe. Esto permite a un atacante autenticado realizar una denegaci\u00f3n de servicio (DoS) basada en la interfaz de usuario (IU) inyectando iframes de gran tama\u00f1o que bloquean la interfaz del foro e interrumpen las interacciones normales de los usuarios. Este problema se ha corregido en la versi\u00f3n 2.2.0."}], "lastModified": "2025-05-13T15:40:58.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A429B30-0D89-49F2-BAE4-61911F252441", "versionEndExcluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}