CVE-2025-30345

An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openslides:openslides:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-21 06:15

Updated : 2025-03-27 14:38

NVD link : CVE-2025-30345

Mitre link : CVE-2025-30345

CVE.ORG link : CVE-2025-30345

JSON object : View

Products Affected

openslides

openslides

CWE

CWE-116

Improper Encoding or Escaping of Output

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-30345", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.3}]}, "published": "2025-03-21T06:15:27.090", "references": [{"url": "https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-116"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages."}, {"lang": "es", "value": "Se detect\u00f3 un problema en OpenSlides antes de la versi\u00f3n 4.2.5. Al crear nuevos chats mediante la acci\u00f3n chat_group.create, el usuario puede especificar el nombre del chat. Algunos elementos HTML, como SCRIPT, se filtran, mientras que otros no. En la mayor\u00eda de los casos, las entidades HTML se codifican correctamente, pero no al eliminar chats o mensajes en estos. Esto podr\u00eda permitir a los atacantes interferir con el dise\u00f1o del sitio web, pero es improbable que las v\u00edctimas hagan clic en chats o mensajes eliminados."}], "lastModified": "2025-03-27T14:38:50.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openslides:openslides:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9F2C3CC-918A-4329-A59D-DEFECC0489A1", "versionEndExcluding": "4.2.5"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}