CVE-2025-48992

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48992
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27.
CVSS

No CVSS.

References
Link Resource
https://github.com/Intermesh/groupoffice/commit/2e3695db9cdef1da7a9d754ff4d98f49f6924e2d
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j35g-q5mc-jwgp
Configurations

No configuration.

History

17 Jun 2025, 20:50

Type Values Removed Values Added
Summary
  • (es) Group-Office es una herramienta de gestión de relaciones con clientes empresariales y groupware. En versiones anteriores a la 6.8.123 y la 25.0.27, existía una vulnerabilidad de cross site scripting (XSS) almacenado y ciego en el campo Nombre del perfil de usuario. Un atacante malintencionado puede cambiar su nombre por un payload de JavaScript, que se ejecuta cuando un usuario añade al usuario malintencionado a sus libretas de direcciones de Sincronización. Este problema se ha corregido en las versiones 6.8.123 y la 25.0.27.

17 Jun 2025, 01:15

Type Values Removed Values Added
Summary (en) Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27. (en) Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27.

16 Jun 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-16 23:15

Updated : 2025-06-17 20:50

NVD link : CVE-2025-48992

Mitre link : CVE-2025-48992

CVE.ORG link : CVE-2025-48992

JSON object : View

Products Affected

No product.

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-87

Improper Neutralization of Alternate XSS Syntax