CVE-2025-13671

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-13671
Cross-Site Request Forgery (CSRF) vulnerability in OpenText™ Web Site Management Server allows Cross Site Request Forgery. The vulnerability could make a user, with active session inside the product, click on a page that contains this malicious HTML triggering to perform changes unconsciously. This issue affects Web Site Management Server: 16.7.0, 16.7.1.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.opentext.com/csm/en?id=ot_kb_unauthenticated&sysparm_article=KB0854846 Vendor Advisory
https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2025-13671/README.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:opentext:web_site_management_server:16.7.0:*:*:*:*:*:*:*
cpe:2.3:a:opentext:web_site_management_server:16.7.1:*:*:*:*:*:*:*
History

27 Feb 2026, 23:56

Type Values Removed Values Added
CPE cpe:2.3:a:opentext:web_site_management_server:16.7.0:*:*:*:*:*:*:*
cpe:2.3:a:opentext:web_site_management_server:16.7.1:*:*:*:*:*:*:*
First Time Opentext
Opentext web Site Management Server
References () https://support.opentext.com/csm/en?id=ot_kb_unauthenticated&sysparm_article=KB0854846 - () https://support.opentext.com/csm/en?id=ot_kb_unauthenticated&sysparm_article=KB0854846 - Vendor Advisory
References () https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2025-13671/README.md - () https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2025-13671/README.md - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

24 Feb 2026, 15:21

Type Values Removed Values Added
References
  • () https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2025-13671/README.md -
Summary
  • (es) Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en OpenText™ Web Site Management Server permite la falsificación de petición en sitios cruzados. La vulnerabilidad podría hacer que un usuario, con sesión activa dentro del producto, haga clic en una página que contiene este HTML malicioso, desencadenando la realización de cambios inconscientemente. Este problema afecta a Web Site Management Server: 16.7.0, 16.7.1.

19 Feb 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-19 23:16

Updated : 2026-02-27 23:56

NVD link : CVE-2025-13671

Mitre link : CVE-2025-13671

CVE.ORG link : CVE-2025-13671

JSON object : View

Products Affected

opentext

  • web_site_management_server
CWE
CWE-352

Cross-Site Request Forgery (CSRF)