{"id":"CVE-2025-5412","state":"PUBLISHED","title":"Mist Community Edition Authentication Endpoint views.py login cross site scripting","description":"A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.py of the component Authentication Endpoint. The manipulation of the argument return_to leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The name of the patch is db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.","publishedAt":"2025-06-01T23:31:05.448Z","updatedAt":"2025-06-02T03:33:00.189Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["Mist Community Edition"],"affected":[{"vendor":"Mist","product":"Community Edition","versions":[{"version":"4.7.0","status":"affected"},{"version":"4.7.1","status":"affected"}],"modules":["Authentication Endpoint"]}],"references":["https://vuldb.com/?id.310752","https://vuldb.com/?ctiid.310752","https://vuldb.com/?submit.583534","https://github.com/Stolichnayer/mist-ce-open-redirect","https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad","https://github.com/mistio/mist-ce/releases/tag/v4.7.2"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/5xxx/CVE-2025-5412.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-5412","state":"PUBLISHED","datePublished":"2025-06-01T23:31:05.448Z","dateUpdated":"2025-06-02T03:33:00.189Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-05-31T16:51:19.004Z"},"containers":{"cna":{"title":"Mist Community Edition Authentication Endpoint views.py login cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.py of the component Authentication Endpoint. The manipulation of the argument return_to leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The name of the patch is db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component."},{"lang":"de","value":"Es wurde eine problematische Schwachstelle in Mist Community Edition bis 4.7.1 entdeckt. Es geht dabei um die Funktion Login der Datei src/mist/api/views.py der Komponente Authentication Endpoint. Mit der Manipulation des Arguments return_to mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung. Ein Aktualisieren auf die Version 4.7.2 vermag dieses Problem zu lösen. Der Patch wird als db10ecb62ac832c1ed4924556d167efb9bc07fad bezeichnet. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen."}],"affected":[{"vendor":"Mist","product":"Community Edition","versions":[{"version":"4.7.0","status":"affected"},{"version":"4.7.1","status":"affected"}],"modules":["Authentication Endpoint"]}],"references":[{"url":"https://vuldb.com/?id.310752","name":"VDB-310752 | Mist Community Edition Authentication Endpoint views.py login cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.310752","name":"VDB-310752 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.583534","name":"Submit #583534 | Mist.io Mist Community Edition (CE) 4.7.1 Open Redirect","tags":["third-party-advisory"]},{"url":"https://github.com/Stolichnayer/mist-ce-open-redirect","tags":["exploit"]},{"url":"https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad","tags":["patch"]},{"url":"https://github.com/mistio/mist-ce/releases/tag/v4.7.2","tags":["patch"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-06-01T23:31:05.448Z"},"timeline":[{"time":"2025-05-31T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-05-31T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-05-31T18:56:29.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Alex Perrakis","type":"finder"},{"lang":"en","value":"Efstratios Chatzoglou","type":"finder"},{"lang":"en","value":"Georgios Kambourakis","type":"finder"},{"lang":"en","value":"alexperrakis (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-02T03:32:45.716764Z","id":"CVE-2025-5412","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-02T03:33:00.189Z"}}]}}}