{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-47977 Nuance Digital Engagement Platform Spoofing Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47977"
      },
      {
        "category": "self",
        "summary": "CVE-2025-47977 Nuance Digital Engagement Platform Spoofing Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-47977.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Nuance Digital Engagement Platform Spoofing Vulnerability",
    "tracking": {
      "current_release_date": "2025-06-12T07:00:00.000Z",
      "generator": {
        "date": "2025-07-15T16:52:18.404Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-47977",
      "initial_release_date": "2025-06-10T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-06-10T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-06-12T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Updated the CVSS score and corrected FAQs. This is an informational change only."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c5.64.x",
            "product": {
              "name": "Nuance Digital Engagement Platform \u003c5.64.x",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "5.64.x",
            "product": {
              "name": "Nuance Digital Engagement Platform 5.64.x",
              "product_id": "16781"
            }
          }
        ],
        "category": "product_name",
        "name": "Nuance Digital Engagement Platform"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-47977",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "Information in the victim\u0027s browser associated with the vulnerable URL can be read by the malicious JavaScript code and sent to the attacker.",
          "title": "According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L)? What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Affected customers need to enable the Block XSS field in the configurations setting for their program to prevent JavaScript injection. All affected customers have been notified by the Nuance team to make this update.",
          "title": "What actions do I need to take to be protected from this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Exploitation of the vulnerability requires that a user to open a specially crafted link.\nAn attacker would have no way to force users to click the link. Instead, an attacker would have to convince users to click the link through social engineering.",
          "title": "According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?"
        },
        {
          "category": "faq",
          "text": "The vulnerability is in the web server, but the malicious scripts execute in the victim\u2019s browser on their machine.",
          "title": "According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "16781"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47977 Nuance Digital Engagement Platform Spoofing Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47977"
        },
        {
          "category": "self",
          "summary": "CVE-2025-47977 Nuance Digital Engagement Platform Spoofing Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-47977.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-10T07:00:00.000Z",
          "details": "5.64.x:Security Update:https://docs.nuance.com/digital-engagement/ReleaseNotes/ReleaseNotes-5.64.x.html?Highlight=XSS",
          "product_ids": [
            "1"
          ],
          "url": "https://docs.nuance.com/digital-engagement/ReleaseNotes/ReleaseNotes-5.64.x.html?Highlight=XSS"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 7.1,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Spoofing"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Nuance Digital Engagement Platform Spoofing Vulnerability"
    }
  ]
}