CVE-2025-3393

Vulnerability

Overview

A cross-site scripting (XSS) vulnerability has been identified in the Personal Settings Interface of mrcen springboot-ucan-admin, specifically in the /ucan-admin/index endpoint. The issue is classified as problematic with a low severity (CVSS 3.5) [1]. The latest affected commit is up to 5f35162032cbe9288a04e429ef35301545143509; the product does not follow versioning, making affected and unaffected releases unclear [1].

Exploitation

The attack can be initiated remotely without authentication, as the interface is accessible via the web [1]. An attacker can inject malicious scripts into the personal settings form, which are then stored and executed in the browsers of other users viewing the settings page. The exploit has been publicly disclosed and may be used by malicious actors [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, theft of sensitive data, or defacement of the application [1].

Mitigation

As of the publication date, no official patch is available due to the lack of versioning [1]. Users should sanitize all user input and consider implementing Content Security Policy (CSP) or disabling affected functionality until a fix is provided.