CVE-2025-8528

low

Description

A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

References

https://vuldb.com/?submit.622175

https://vuldb.com/?id.318654

https://github.com/Exrick/xboot/issues/69#issue-3252177305

https://vuldb.com/?ctiid.318654

https://github.com/Exrick/xboot/issues/69

Details

Source: Mitre, NVD

Published: 2025-08-04

Updated: 2025-08-28

Risk Information

CVSS v2

Base Score: 2.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

Severity: Low

CVSS v3

Base Score: 5.9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 2.9

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Low

EPSS

EPSS: 0.00021