« Volver al listado

CVE-2025-1534

Estado: AnalizadaMedia (6.8)—

CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5.20.0 before 5.68.0, from 6.0.0 before 6.23.0, from 6.2022.1 before 6.2025.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Payara — Payara

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-1534",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1534",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-01T14:12:47.247787Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 6.8,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "affectedData": [
        {
          "vendor": "Payara Platform",
          "product": "Payara Server",
          "versions": [
            {
              "status": "affected",
              "version": "4.1.2.1919.1",
              "lessThan": "4.1.2.191.51",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.20.0",
              "lessThan": "5.68.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.23.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.2022.1",
              "lessThan": "6.2025.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-01T04:15:44.170",
  "references": [
    {
      "url": "https://docs.payara.fish/community/docs/6.2025.3/Release%20Notes/Release%20Notes%206.2025.3.html",
      "tags": [
        "Release Notes"
      ],
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
    },
    {
      "url": "https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.24.0.html",
      "tags": [
        "Release Notes"
      ],
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
    },
    {
      "url": "https://www.gruppotim.it/it/footer/red-team.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5.20.0 before 5.68.0, from 6.0.0 before 6.23.0, from 6.2022.1 before 6.2025.2."
    },
    {
      "lang": "es",
      "value": "CVE-79: Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Payara Platform Payara Server permite: Inclusión de código remoto. Este problema afecta a Payara Server: desde 4.1.2.1919.1 antes de 4.1.2.191.51, desde 5.20.0 antes de 5.68.0, desde 6.0.0 antes de 6.23.0, desde 6.2022.1 antes de 6.2025.2."
    }
  ],
  "lastModified": "2026-06-17T08:39:19.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9585BCC9-5D17-41AE-991C-EC4B94DAD720",
              "versionEndExcluding": "4.1.2.191.51",
              "versionStartIncluding": "4.1.2.191.1"
            },
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B1B47A2-B9C1-4C93-AE5A-1772EEAA4F65",
              "versionEndExcluding": "5.68.0",
              "versionStartIncluding": "5.20.0"
            },
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54BD5044-171B-46DC-A4D9-42D7CA12DADA",
              "versionEndExcluding": "6.24.0",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42EBCFDC-9538-4229-8FD5-E7EB7A6F73F1",
              "versionEndExcluding": "6.2025.3",
              "versionStartIncluding": "6.2022.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
}