CVE-2025-1420

Vulnerability

Overview

The vulnerability resides in the activationMessage field within the Proget server component (Konsola Proget). Input provided in this field is not properly sanitized, enabling a stored cross-site scripting (XSS) attack [1]. The issue affects all versions prior to 2.17.5.

Exploitation

To exploit this vulnerability, an attacker must already hold high-privileged user credentials within the Proget MDM console. The unsanitized input is stored on the server and later rendered in a way that allows arbitrary JavaScript execution when the field is viewed by other users [1]. This means the attack is carried out from within the administrative interface.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript within the context of other users' sessions, potentially leading to session hijacking, unauthorized actions, or data exfiltration [1]. Because the attack is stored and triggered when the malicious input is rendered, it can affect multiple users without further interaction from the attacker.

Mitigation

The vendor has fixed the issue in version 2.17.5 of the server component. Users are advised to upgrade to this or any later version to remediate the vulnerability [1]. No workarounds have been publicly documented.