CVE-2025-1987

Estado: AnalizadaCrítica (9.3)—

A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 9.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.57%
Percentil entre todas las CVEs puntuadas: 45
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1189 Drive-by Compromiseinitial access95 %
Impacto principalT1059.007 JavaScriptexecution90 %
Impacto secundarioT1005 Data from Local Systemcollection85 %

XSS en campo URL (CWE-79) ejecutado al interactuar con entrada maliciosa del vault; requiere UI:P. Ejecución de JavaScript en navegador (T1059.007) y acceso al vault de contraseñas (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based Content User Training Execution Prevention Behavior Prevention on Endpoint Disable or Remove Feature or Program Application Isolation and Sandboxing

Tecnologías afectadas (2)

Bitdefender — Securepass Esaqa — Psono Client

CWE

CWE-79

Referencias

https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-1987",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1987",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-23T14:56:38.593939Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cve-requests@bitdefender.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cve-requests@bitdefender.com",
      "affectedData": [
        {
          "vendor": "Psono",
          "product": "Psono-client",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "git",
              "lessThanOrEqual": "4.0.4"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Bitdefender",
          "product": "SecurePass",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.0.76",
              "versionType": "Web client"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.1.18",
              "versionType": "Chrome"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.1.22",
              "versionType": "Firefox"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.1.18",
              "versionType": "Edge"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.0.10",
              "versionType": "Safari"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-21T22:15:21.510",
  "references": [
    {
      "url": "https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "cve-requests@bitdefender.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-requests@bitdefender.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) en la gestión por parte de Psono-Client de las entradas de la bóveda de tipo \"website_password\" y \"bookmark\", utilizadas en Bitdefender SecurePass. El cliente no depura correctamente el campo URL de estas entradas. Como resultado, un atacante puede manipular una entrada de bóveda maliciosa (o engañar al usuario para que la cree o importe) con una URL javascript:URL. Cuando el usuario interactúa con esta entrada (por ejemplo, al hacer clic o abrirla), la aplicación ejecuta el JavaScript malicioso en el contexto de la bóveda de Psono. Esto permite a un atacante ejecutar código arbitrario en el navegador de la víctima, lo que podría otorgarle acceso a la bóveda de contraseñas y a datos confidenciales del usuario."
    }
  ],
  "lastModified": "2026-06-17T08:40:29.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:esaqa:psono_client:*:*:*:*:-:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AE78704-9176-4954-9F82-AA53849BB7B3",
              "versionEndIncluding": "4.0.4"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bitdefender:securepass:*:*:*:*:web_client:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "233DA21C-F9D0-4196-AD5D-F40BE2DC8E2A",
              "versionEndExcluding": "0.0.76"
            },
            {
              "criteria": "cpe:2.3:a:bitdefender:securepass:*:*:*:*:safari:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44601CA9-4F9C-425B-97EB-D4CD0C895B88",
              "versionEndExcluding": "1.0.10"
            },
            {
              "criteria": "cpe:2.3:a:bitdefender:securepass:*:*:*:*:chrome:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B98481EF-DE72-4B7B-97D4-E4BB072F3C7E",
              "versionEndExcluding": "1.1.8"
            },
            {
              "criteria": "cpe:2.3:a:bitdefender:securepass:*:*:*:*:edge:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E70B0018-6B1F-46D3-AA24-B22C5579E6A8",
              "versionEndExcluding": "1.1.18"
            },
            {
              "criteria": "cpe:2.3:a:bitdefender:securepass:*:*:*:*:firefox:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C62D36DB-35BE-498D-B0CD-3B88049B0600",
              "versionEndExcluding": "1.1.22"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-requests@bitdefender.com"
}