certfr_avis - CERTFR-2025-AVI-0531

CERTFR-2025-AVI-0531

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Bitdefender SecurePass. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Bitdefender	SecurePass	Greffon SecurePass pour Firefox versions antérieures à 1.1.22
Bitdefender	SecurePass	Greffon SecurePass pour Chrome et Edge versions antérieures à 1.1.18
Bitdefender	SecurePass	Client web SecurePass versions antérieures à 0.0.76
Bitdefender	SecurePass	Greffon SecurePass pour Safari versions antérieures à 1.0.10

References

Title

Publication Time

CVE-2025-1987 (GCVE-0-2025-1987)

Vulnerability from cvelistv5 – Published: 2025-06-21 21:35 – Updated: 2025-06-23 14:56

Summary

A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data.

Severity ?

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

Bitdefender

References

URL

Tags

https://bitdefender.com/support/support/security-…

Impacted products

Vendor

Product

Version

Psono

Psono-client

Affected: 0 , ≤ 4.0.4 (git)

Bitdefender

SecurePass

Affected: 0 , < 0.0.76 (Web client)
Affected: 0 , < 1.1.18 (Chrome)
Affected: 0 , < 1.1.22 (Firefox)
Affected: 0 , < 1.1.18 (Edge)
Affected: 0 , < 1.0.10 (Safari)

Credits

Ionut DRĂGUȚ, Bitdefender Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1987",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-23T14:56:38.593939Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-23T14:56:45.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Psono-client",
          "vendor": "Psono",
          "versions": [
            {
              "lessThanOrEqual": "4.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SecurePass",
          "vendor": "Bitdefender",
          "versions": [
            {
              "lessThan": "0.0.76",
              "status": "affected",
              "version": "0",
              "versionType": "Web client"
            },
            {
              "lessThan": "1.1.18",
              "status": "affected",
              "version": "0",
              "versionType": "Chrome"
            },
            {
              "lessThan": "1.1.22",
              "status": "affected",
              "version": "0",
              "versionType": "Firefox"
            },
            {
              "lessThan": "1.1.18",
              "status": "affected",
              "version": "0",
              "versionType": "Edge"
            },
            {
              "lessThan": "1.0.10",
              "status": "affected",
              "version": "0",
              "versionType": "Safari"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ionut DR\u0102GU\u021a, Bitdefender Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA \u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e\u0026nbsp;vulnerability has been identified in Psono-Client\u2019s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim\u2019s browser, potentially giving them access to the user\u2019s password vault and sensitive data.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "A Cross-Site Scripting (XSS)\u00a0vulnerability has been identified in Psono-Client\u2019s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim\u2019s browser, potentially giving them access to the user\u2019s password vault and sensitive data."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-21T21:35:06.643Z",
        "orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
        "shortName": "Bitdefender"
      },
      "references": [
        {
          "url": "https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An automatic update to these product versions fixes the issue:\u003cbr\u003e\u003cbr\u003e\u003cul\u003e\u003cli\u003eWeb client: 0.0.76\u003c/li\u003e\u003cli\u003eChrome: 1.1.18\u003c/li\u003e\u003cli\u003eFirefox: 1.1.22\u003c/li\u003e\u003cli\u003eEdge: 1.1.18\u003c/li\u003e\u003cli\u003eSafari: 1.0.10\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "An automatic update to these product versions fixes the issue:\n\n  *  Web client: 0.0.76\n  *  Chrome: 1.1.18\n  *  Firefox: 1.1.22\n  *  Edge: 1.1.18\n  *  Safari: 1.0.10"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Stored XSS in Psono-Client via Malicious Vault Entry URLs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
    "assignerShortName": "Bitdefender",
    "cveId": "CVE-2025-1987",
    "datePublished": "2025-06-21T21:35:06.643Z",
    "dateReserved": "2025-03-05T14:48:09.124Z",
    "dateUpdated": "2025-06-23T14:56:45.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted