CVE-2025-48366

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-48366

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48366.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-48366

Aliases

GHSA-phhq-3h8f-qxpx

Published

2025-05-22T17:28:26.530Z

Modified

2026-08-12T03:51:30.348878017Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P CVSS Calculator

Summary

GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

Details

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the context of another user when they view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or other arbitrary JavaScript execution without user interaction. Versions 6.8.119 and 25.0.20 contain a fix for the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48366.json",
    "cwe_ids": [
        "CWE-79",
        "CWE-87"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/intermesh/groupoffice

Affected ranges

Type

GIT

Repo

https://github.com/intermesh/groupoffice

Events

Introduced

86a5e33c9c9adfc29537c29d42fb0029f456837b

Fixed

4fb53aecde1152823d459d7c97546b84e654714c

Database specific

Show details

{
    "cpe": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "25.0.1"
        },
        {
            "fixed": "25.0.20"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48366.json"