CVE-2025-0971

Summary

A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of the argument username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.

Affected Software

VendorProductVersion RangeStatus
ZenviaMovidesk25.01.0affected
ZenviaMovidesk25.01.1affected
ZenviaMovidesk25.01.2affected
ZenviaMovidesk25.01.3affected
ZenviaMovidesk25.01.4affected
ZenviaMovidesk25.01.5affected
ZenviaMovidesk25.01.6affected
ZenviaMovidesk25.01.7affected
ZenviaMovidesk25.01.8affected
ZenviaMovidesk25.01.9affected
ZenviaMovidesk25.01.10affected
ZenviaMovidesk25.01.11affected
ZenviaMovidesk25.01.12affected
ZenviaMovidesk25.01.13affected
ZenviaMovidesk25.01.14affected
ZenviaMovidesk25.01.15affected
ZenviaMovidesk25.01.16affected
ZenviaMovidesk25.01.17affected
ZenviaMovidesk25.01.18affected
ZenviaMovidesk25.01.19affected
ZenviaMovidesk25.01.20affected
ZenviaMovidesk25.01.21affected
ZenviaMovidesk25.01.22affected

Weaknesses

  • CWE-79: Cross Site Scripting
  • CWE-94: Code Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References