Reflected Cross-Site Scripting in ZOO-Project Web Processing Service
CVE-2025-25189

5.5MEDIUM

Key Information:

Vendor
Zoo-project
Status
Zoo-project
Vendor
CVE Published:
10 February 2025

Summary

A reflected Cross-Site Scripting vulnerability exists in the ZOO-Project Web Processing Service (WPS) before commit 7a5ae1a due to inadequate sanitization of input parameters. Specifically, the CGI script 'publish.py' reflects user input from the 'jobid' parameter directly in its HTTP response without proper HTML encoding. This flaw allows attackers to craft malicious URLs that, when visited by unsuspecting users, can execute arbitrary JavaScript in the victims’ browsers, potentially leading to data theft or session hijacking. A fix is available in commit 7a5ae1a.

Affected Version(s)

ZOO-Project < 7a5ae1a

References

https://github.com/ZOO-Project/ZOO-Project/security/advis...
x_refsource_CONFIRM
https://github.com/ZOO-Project/ZOO-Project/commit/7a5ae1a...
x_refsource_MISC

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.