CVE-2025-31165 - Vulnerability Details - OpenCVE

Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00107.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2025-8269	Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.

Fixes

Solution

Implement secure coding practices for the markdown editor to mitigate vulnerability.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://bug.report.night-wolf.io/changelogs

History

Thu, 27 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 27 Mar 2025 04:15:00 +0000

Type	Values Removed	Values Added
Description		Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.
Title		Cross Site Scripting in NightWolf Penetration Platform
Weaknesses		CWE-79
References		https://bug.report.night-wolf.io/changelogs
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: FSOFT

Published: 2025-03-27T04:00:55.276Z

Updated: 2025-03-28T03:58:34.636Z

Reserved: 2025-03-27T03:51:31.693Z

Link: CVE-2025-31165

Vulnrichment

Updated: 2025-03-27T14:36:11.321Z

NVD

Status : Awaiting Analysis

Published: 2025-03-27T04:15:29.567

Modified: 2025-03-27T16:45:27.850

Link: CVE-2025-31165

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-31165", "assignerOrgId": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "state": "PUBLISHED", "assignerShortName": "FSOFT", "dateReserved": "2025-03-27T03:51:31.693Z", "datePublished": "2025-03-27T04:00:55.276Z", "dateUpdated": "2025-03-28T03:58:34.636Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["logbug"], "product": "NightWolf Penetration Platform", "vendor": "FPT Software", "versions": [{"status": "affected", "version": "1.2.2", "versionType": "custom"}, {"status": "unaffected", "version": "1.2.3", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Do Quang Dat (datdq111@gmail.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><div><div><p>Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.</p></div></div></div></div>"}], "value": "Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "shortName": "FSOFT", "dateUpdated": "2025-03-28T03:58:34.636Z"}, "references": [{"url": "https://bug.report.night-wolf.io/changelogs"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Implement secure coding practices for the markdown editor to mitigate vulnerability."}], "value": "Implement secure coding practices for the markdown editor to mitigate vulnerability."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2025-03-18T08:00:00.000Z", "value": "The reported vulnerability has been submitted for the developer's review and resolution."}, {"lang": "en", "time": "2025-03-18T10:00:00.000Z", "value": "The reported vulnerability has been triaged, verified, and submitted for the developer's review and resolution."}, {"lang": "en", "time": "2025-03-19T06:00:00.000Z", "value": "The fixed version (1.2.3) has been released and deployed to the log bug server."}, {"lang": "en", "time": "2025-03-27T04:00:00.000Z", "value": "The CVE has been officially released and assigned to the reporter."}], "title": "Cross Site Scripting in NightWolf Penetration Platform", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-27T14:36:02.883849Z", "id": "CVE-2025-31165", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T14:36:34.280Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-31165", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-27T14:36:02.883849Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T14:36:11.321Z"}}], "cna": {"title": "Cross Site Scripting in NightWolf Penetration Platform", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Do Quang Dat (datdq9@fpt.com)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "FPT Software", "modules": ["logbug"], "product": "NightWolf Penetration Platform", "versions": [{"status": "affected", "version": "1.2.2", "versionType": "custom"}, {"status": "unaffected", "version": "1.2.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bug.report.night-wolf.io/changelogs"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.", "supportingMedia": [{"type": "text/html", "value": "<div><div><div><div><p>Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.</p></div></div></div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "shortName": "FSOFT", "dateUpdated": "2025-03-27T04:14:21.223Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31165", "state": "PUBLISHED", "dateUpdated": "2025-03-27T14:36:34.280Z", "dateReserved": "2025-03-27T03:51:31.693Z", "assignerOrgId": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "datePublished": "2025-03-27T04:00:55.276Z", "assignerShortName": "FSOFT"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature."}, {"lang": "es", "value": "La vulnerabilidad de Cross-Site Scripting (XSS) en el m\u00f3dulo Logbug de NightWolf Penetration Testing Platform 1.2.2 permite a los atacantes ejecutar JavaScript a trav\u00e9s de la funci\u00f3n del editor de rebajas."}], "id": "CVE-2025-31165", "lastModified": "2025-03-27T16:45:27.850", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "type": "Secondary"}]}, "published": "2025-03-27T04:15:29.567", "references": [{"source": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "url": "https://bug.report.night-wolf.io/changelogs"}], "sourceIdentifier": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "5ac195ad-69e7-48e7-9c1e-bfc958c39761", "type": "Secondary"}]}