{"id":"CVE-2025-64758","sourceIdentifier":"security-advisories@github.com","published":"2025-11-17T18:15:58.450","lastModified":"2026-10-18T20:10:00.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a \"welcome message\", which is HTML that is to be rendered on the login page for branding purposes. When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed. Users with the SYSTEM_CONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page. The issue has been fixed in version 4.13.6."},{"lang":"es","value":"@dependencytrack/frontend es una Aplicación de Página Única (SPA) utilizada en Dependency-Track, una plataforma de Análisis de Componentes de código abierto que permite a las organizaciones identificar y reducir el riesgo en la cadena de suministro de software. Desde la versión 4.12.0, los usuarios de Dependency-Track con el permiso SYSTEM_CONFIGURATION pueden configurar un “mensaje de bienvenida”, que es HTML que se renderizará en la página de inicio de sesión con fines de marca. Al renderizar el mensaje de bienvenida, las versiones de Dependency-Track anteriores a la 4.13.6 no sanitizaban correctamente el HTML, permitiendo la ejecución de JavaScript arbitrario. Los usuarios con el permiso SYSTEM_CONFIGURATION (es decir, administradores) pueden exploit esta vulnerabilidad para ejecutar JavaScript arbitrario para los usuarios que navegan a la página de inicio de sesión. El problema ha sido solucionado en la versión 4.13.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"DependencyTrack","product":"frontend","versions":[{"version":">= 4.12.0, < 4.13.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-17T21:05:00.585584Z","id":"CVE-2025-64758","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/DependencyTrack/frontend/commit/8fd757be612eaf4f35eadbe4c334204d7bd711be","source":"security-advisories@github.com"},{"url":"https://github.com/DependencyTrack/frontend/pull/1378","source":"security-advisories@github.com"},{"url":"https://github.com/DependencyTrack/frontend/pull/986","source":"security-advisories@github.com"},{"url":"https://github.com/DependencyTrack/frontend/security/advisories/GHSA-7xvh-c266-cfr5","source":"security-advisories@github.com"}]}