CVE-2025-37109 - Vulnerability Details - OpenCVE

Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Hpe	Telco Service Activator

No data.

No data.

References

Link	Providers
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US

History

Mon, 04 Aug 2025 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-79

Mon, 04 Aug 2025 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Hpe Hpe telco Service Activator
Vendors & Products		Hpe Hpe telco Service Activator

Thu, 31 Jul 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 31 Jul 2025 19:30:00 +0000

Type	Values Removed	Values Added
Description		Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product
Title		HPE Telco Service Activator, Protection Mechanism Failure
References		https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US
Metrics		cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: hpe

Published: 2025-07-31T19:20:44.918Z

Updated: 2025-08-04T18:30:39.560Z

Reserved: 2025-04-16T01:28:25.364Z

Link: CVE-2025-37109

Vulnrichment

Updated: 2025-07-31T19:36:02.856Z

NVD

Status : Awaiting Analysis

Published: 2025-07-31T20:15:32.520

Modified: 2025-08-04T19:15:30.953

Link: CVE-2025-37109

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-37109", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2025-04-16T01:28:25.364Z", "datePublished": "2025-07-31T19:20:44.918Z", "dateUpdated": "2025-08-04T18:30:39.560Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HPE Telco Service Activator", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThan": "<10.3.2", "status": "affected", "version": "10.3.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product</span>"}], "value": "Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-07-31T19:20:44.918Z"}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US"}], "source": {"advisory": "HPESBNW04887", "discovery": "UNKNOWN"}, "title": "HPE Telco Service Activator, Protection Mechanism Failure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-31T19:35:57.630177Z", "id": "CVE-2025-37109", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T18:30:39.560Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37109", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-31T19:35:57.630177Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-31T19:36:02.856Z"}}], "cna": {"title": "HPE Telco Service Activator, Protection Mechanism Failure", "source": {"advisory": "HPESBNW04887", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Telco Service Activator", "versions": [{"status": "affected", "version": "10.3.0", "lessThan": "<10.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product</span>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-07-31T19:20:44.918Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37109", "state": "PUBLISHED", "dateUpdated": "2025-08-04T18:30:39.560Z", "dateReserved": "2025-04-16T01:28:25.364Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2025-07-31T19:20:44.918Z", "assignerShortName": "hpe"}, "dataVersion": "5.1"}