« Volver al listado

CVE-2025-14340

Estado: AplazadaAlta (7.3)—

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS en interfaz web (CWE-79, vector CVSS con UI:A) permite engañar al administrador para cambiar contraseña (T1078) mediante payload URL malicioso (T1189), con ejecución de JavaScript posible (T1059.007).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict Web-Based ContentApplication Developer GuidanceActive Directory ConfigurationUser Account ManagementPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Payara — Payara ServerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-14340",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14340",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-18T14:09:45.635406Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
        "cvssData": {
          "Safety": "PRESENT",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 7.3,
          "Automatable": "NO",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:X/RE:M/U:Red",
          "exploitMaturity": "UNREPORTED",
          "providerUrgency": "RED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "affectedData": [
        {
          "vendor": "Payara Platform",
          "product": "Payara Server",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.153.1",
              "versionType": "custom",
              "lessThanOrEqual": "4.1.2.191.53"
            },
            {
              "status": "affected",
              "version": "5.20.0",
              "versionType": "semver",
              "lessThanOrEqual": "5.82.0"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.33.0"
            },
            {
              "status": "affected",
              "version": "7.2024.1.Alpha1",
              "versionType": "semver",
              "lessThanOrEqual": "7.2025.2"
            },
            {
              "status": "affected",
              "version": "6.2022.1",
              "versionType": "semver",
              "lessThanOrEqual": "6.2025.11"
            },
            {
              "status": "affected",
              "version": "5.2020.2",
              "versionType": "semver",
              "lessThanOrEqual": "5.2022.5"
            },
            {
              "status": "affected",
              "version": "5.181",
              "versionType": "semver",
              "lessThanOrEqual": "5.201.2"
            },
            {
              "status": "unaffected",
              "version": "4.1.2.191.54",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "5.83.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.34.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2026.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-18T14:16:00.970",
  "references": [
    {
      "url": "https://docs.payara.fish/enterprise/docs/Security/Security%20Fix%20List.html",
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload."
    },
    {
      "lang": "es",
      "value": "Cross-site scripting en la Interfaz de Gestión REST en Payara Server &lt;4.1.2.191.54, &lt;5.83.0, &lt;6.34.0, &lt;7.2026.1 permite a un atacante engañar al administrador para cambiar la contraseña de administrador a través de una carga útil de URL."
    }
  ],
  "lastModified": "2026-06-17T08:35:46.503",
  "sourceIdentifier": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
}