« Volver al listado

CVE-2025-58146

Estado: AplazadaCrítica (9.4)—

There are multiple issues.

Detalles técnicos trazas, registros y código del informe original
 1. Updates to the XAPI database sanitise input strings, but try
    generating the notification using the unsanitised input.  This
    causes the database's event thread to terminate and cease further
    processing.

 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI
    uses libraries which conform to the stricter v3.1 of the Unicode
    spec.  This causes some strings to be accepted as valid UTF-8 by
    XAPI, but rejected by other libraries in use.  Notably, such strings
    can be entered into the database, after which the database can no
    longer be loaded.

 3. There is no input sanitisation for Map/Set updates on objects in the
    XAPI database.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L sin UI:R ni PR sugiere escalada local (T1068). Los tres problemas causan DoS del evento/BD (T1499.004) y corrupción de datos en BD (T1565.001) mediante inyección sin sanitizar (CWE-20).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageFilter Network TrafficExecution PreventionEncrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Citrix — XapiAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-58146",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-58146",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-09T16:07:50.376243Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@xen.org",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.4,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@xen.org",
      "affectedData": [
        {
          "vendor": "Xen",
          "product": "XAPI",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-09T16:16:33.687",
  "references": [
    {
      "url": "https://xenbits.xen.org/xsa/advisory-474.html",
      "source": "security@xen.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/09/09/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://xenbits.xen.org/xsa/advisory-474.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@xen.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There are multiple issues.\n\n 1. Updates to the XAPI database sanitise input strings, but try\n    generating the notification using the unsanitised input.  This\n    causes the database's event thread to terminate and cease further\n    processing.\n\n 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI\n    uses libraries which conform to the stricter v3.1 of the Unicode\n    spec.  This causes some strings to be accepted as valid UTF-8 by\n    XAPI, but rejected by other libraries in use.  Notably, such strings\n    can be entered into the database, after which the database can no\n    longer be loaded.\n\n 3. There is no input sanitisation for Map/Set updates on objects in the\n    XAPI database."
    },
    {
      "lang": "es",
      "value": "Hay múltiples problemas.\n\n1. Las actualizaciones a la base de datos XAPI sanitizan las cadenas de entrada, pero intentan generar la notificación usando la entrada no sanitizada. Esto provoca que el hilo de eventos de la base de datos termine y cese el procesamiento posterior.\n\n2. El codificador UTF-8 de XAPI implementa la v3.0 de la especificación Unicode, pero XAPI utiliza bibliotecas que cumplen con la v3.1 más estricta de la especificación Unicode. Esto provoca que algunas cadenas sean aceptadas como UTF-8 válido por XAPI, pero rechazadas por otras bibliotecas en uso. En particular, dichas cadenas pueden introducirse en la base de datos, después de lo cual la base de datos ya no puede cargarse.\n\n3. No hay sanitización de entrada para actualizaciones de Map/Set en objetos en la base de datos XAPI."
    }
  ],
  "lastModified": "2026-09-29T19:10:00.160",
  "sourceIdentifier": "security@xen.org"
}