Riskcovery

CVE-2025-5198

Stackrox: xss in stackrox

State
Published
Severity
5.0 Medium
Published
May 27, 2025
Updated
Feb 27, 2026
Reserved
May 26, 2025

Read the record on cve.org

Description

A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting (XSS) if the script code is included in a small subset of table cells. The only known potential exploit is if the script is included in the name of a Kubernetes “Role” object* that is applied to a secured cluster. This object can be used by a user with access to the cluster or through a compromised third-party product.

Scores

CVSSScoreVectorSource
3.15.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:Lredhat

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
stackrox
  • 4.4.0 to before 4.4.8Affected
  • 4.5.0 to before 4.5.6Affected
  • 4.6.0 and laterNot affected
Red Hat Advanced Cluster Security 4Red Hat
    Red Hat Advanced Cluster Security 4Red Hat
      Red Hat Advanced Cluster Security 4Red Hat
        Red Hat Advanced Cluster Security 4Red Hat
          Red Hat Advanced Cluster Security 4Red Hat
            Red Hat Advanced Cluster Security 4Red Hat
              Red Hat Advanced Cluster Security 4Red Hat
                Red Hat Advanced Cluster Security 4Red Hat
                  Red Hat Advanced Cluster Security 4Red Hat
                    Red Hat Advanced Cluster Security 4Red Hat

                      References

                      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.