Vulnerability · Published May 22, 2025 · Assigned by GitHub_M
CVE-2025-48366GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions
Medium 6.9
In plain English
A medium-severity cross-site scripting in groupoffice from Intermesh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the context of another user when they view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or other arbitrary JavaScript execution without user interaction. Versions 6.8.119 and 25.0.20 contain a fix for the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Intermesh | groupoffice | < 6.8.119< 25.0.20 |
Weakness: CWE-79, CWE-87 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P
References
- https://github.com/Intermesh/groupoffice/security/advisories/GHSA-phhq-3h8f-qxpx x_refsource_CONFIRM