CVE-2025-0971

Zenvia Movidesk Profile Editing EditProfile cross site scripting

State: Published
Severity: 5.3 Medium
Published: Feb 2, 2025
Updated: Feb 12, 2025
Reserved: Feb 2, 2025

Description

A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of the argument username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
MovideskZenvia	25.01.0Affected 25.01.1Affected 25.01.2Affected 25.01.3Affected 25.01.4Affected 25.01.5Affected 25.01.6Affected 25.01.7Affected 25.01.8Affected 25.01.9Affected 25.01.10Affected 25.01.11Affected 25.01.12Affected 25.01.13Affected 25.01.14Affected 25.01.15Affected 25.01.16Affected 25.01.17Affected 25.01.18Affected 25.01.19Affected 25.01.20Affected 25.01.21Affected 25.01.22Affected

References

VDB-294362 | Zenvia Movidesk Profile Editing EditProfile cross site scriptingvdb-entrytechnical-description
VDB-294362 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #486023 | zenvia movidesk 25.01.15.86c796efe6 Cross Site Scriptingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.