FKIE_CVE-2025-30084

Vulnerability from fkie_nvd - Published: 2025-06-05 14:15 - Updated: 2025-08-13 15:14
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.
References
security@joomla.orghttps://rsjoomla.com/Product
Impacted products
Vendor Product Version
rsjoomla rsmail\! *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rsjoomla:rsmail\\!:*:*:*:*:*:joomla\\!:*:*",
              "matchCriteriaId": "FFBF735B-4BB8-45FE-9EC8-D2CE37987515",
              "versionEndIncluding": "1.22.26",
              "versionStartIncluding": "1.19.20",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard  component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard."
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 una vulnerabilidad de XSS almacenado en el componente RSMail! 1.19.20 - 1.22.26 para Joomla. El problema ocurre en el componente del panel de control, donde la informaci\u00f3n proporcionada por el usuario no se depura correctamente antes de almacenarse y renderizarse. Un atacante puede inyectar c\u00f3digo JavaScript malicioso en campos de texto u otros puntos de entrada, que posteriormente se ejecuta en el navegador de cualquier usuario que haga clic en el texto manipulado en el panel de control."
    }
  ],
  "id": "CVE-2025-30084",
  "lastModified": "2025-08-13T15:14:25.967",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-06-05T14:15:31.863",
  "references": [
    {
      "source": "security@joomla.org",
      "tags": [
        "Product"
      ],
      "url": "https://rsjoomla.com/"
    }
  ],
  "sourceIdentifier": "security@joomla.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security@joomla.org",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.