« Volver al listado

CVE-2025-30223

Estado: AnalizadaCrítica (9.6)—

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS en RenderForm() de Beego (CWE-79) con UI:R permite inyectar JavaScript (T1189). El atacante ejecuta código en el navegador (T1059.007), pudiendo robar sesiones/credenciales (T1528) o reconocer datos (T1012).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentUser TrainingUser Account ManagementExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or Program

Tecnologías afectadas (1)

Beego — Beego

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-30223",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-30223",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-31T18:20:35.269679Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "beego",
          "product": "beego",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.3.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-31T17:15:42.147",
  "references": [
    {
      "url": "https://github.com/beego/beego/commit/939bb18c66406466715ddadd25dd9ffa6f169e25",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/beego/beego/security/advisories/GHSA-2j42-h78h-q4fg",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6."
    },
    {
      "lang": "es",
      "value": "Beego es un framework web de código abierto para el lenguaje de programación Go. Antes de la versión 2.3.6, existía una vulnerabilidad de Cross-Site Scripting (XSS) en la función RenderForm() de Beego debido al escape HTML incorrecto de datos controlados por el usuario. Esta vulnerabilidad permite a los atacantes inyectar código JavaScript malicioso que se ejecuta en los navegadores de las víctimas, lo que puede provocar el secuestro de sesiones, el robo de credenciales o la apropiación de cuentas. La vulnerabilidad afecta a cualquier aplicación que utilice la función RenderForm() de Beego con datos proporcionados por el usuario. Al ser una función de alto nivel que genera un marcado de formulario completo, muchos desarrolladores asumirían que escapa automáticamente los atributos (como hacen la mayoría de los frameworks). Esta vulnerabilidad se corrigió en la versión 2.3.6."
    }
  ],
  "lastModified": "2026-06-17T09:08:23.193",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CF2EC47-9E67-4751-A02D-04AA60DD00ED",
              "versionEndExcluding": "2.3.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}