Vulnerability · Published Mar 17, 2025 · Assigned by GitHub_M

CVE-2025-27102Agate vulnerable to HTML injection in user signup - Administrator phishing risk

Medium 5.4

In plain English

A medium-severity cross-site scripting in agate from obiba. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)5.4Medium

Exploit odds (30 days)0.5%top 59.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Agate is central authentication server software for OBiBa epidemiology applications. Prior to version 3.3.0, when registering for an Agate account, arbitrary HTML code can be injected into a user's first and last name. This HTML is then rendered in the email sent to administrative users. The Agate service account sends this email and appears trustworthy, making this a significant risk for phishing attacks. Administrative users are impacted, as they can be targeted by unauthenticated users. Version 3.3.0 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
obiba	agate	< 3.3.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P

References

https://github.com/obiba/agate/security/advisories/GHSA-v3wj-7vj5-xj5v x_refsource_CONFIRM
https://github.com/obiba/agate/releases/tag/3.3.0 x_refsource_MISC