Stored HTML Injection in Schedule Restore Archive Functionality Affects Nozomi Networks
CVE-2025-40903
4.8MEDIUM
What is CVE-2025-40903?
A Stored HTML Injection vulnerability exists within the Schedule Restore Archive functionality due to inadequate input parameter validation. An authenticated user with administrative access can create a malicious restore schedule that includes harmful HTML tags. When another user views this schedule, the malicious HTML executes in their browser, raising the risk of phishing attacks and open redirect exploits. While complete XSS exploitation and information disclosure are mitigated by current input validation and Content Security Policy configurations, the potential for harm through this vulnerability remains significant.
Affected Version(s)
CMC 0 < 26.1.0
Guardian 0 < 26.1.0
References
CVSS V4
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was found by Stefano Libero and Andrea Palanca of Nozomi Networks Product Security team during an internal investigation.