CVE-2025-12083 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Civictheme Design System Drupal

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-113

History

Thu, 30 Oct 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal civictheme Design System Drupal drupal
Vendors & Products		Drupal Drupal civictheme Design System Drupal drupal

Wed, 29 Oct 2025 23:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Title		CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2025-113

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-10-29T23:14:33.900Z

Updated: 2025-10-30T14:40:11.746Z

Reserved: 2025-10-22T16:06:23.591Z

Link: CVE-2025-12083

Vulnrichment

Updated: 2025-10-30T14:40:02.920Z

NVD

Status : Awaiting Analysis

Published: 2025-10-30T00:15:34.660

Modified: 2025-10-30T15:15:35.960

Link: CVE-2025-12083

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12083", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-10-22T16:06:23.591Z", "datePublished": "2025-10-29T23:14:33.900Z", "dateUpdated": "2025-10-30T14:40:11.746Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/civictheme", "defaultStatus": "unaffected", "product": "CivicTheme Design System", "repo": "https://git.drupalcode.org/project/civictheme", "vendor": "Drupal", "versions": [{"lessThan": "1.12.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Adam Bramley (acbramley)"}, {"lang": "en", "type": "finder", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Alan Cole (alan.cole)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel (danielgry)"}, {"lang": "en", "type": "remediation developer", "value": "Fiona Morrison (fionamorrison23)"}, {"lang": "en", "type": "remediation developer", "value": "Suchi Garg (gargsuchi)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Richard Gaunt (richardgaunt)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}], "datePublic": "2025-10-22T16:35:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).<p>This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-10-29T23:14:33.900Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-113"}], "source": {"discovery": "UNKNOWN"}, "title": "CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T14:39:43.077712Z", "id": "CVE-2025-12083", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:40:11.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-12083", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T14:39:43.077712Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:40:02.920Z"}}], "cna": {"title": "CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Adam Bramley (acbramley)"}, {"lang": "en", "type": "finder", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Alan Cole (alan.cole)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel (danielgry)"}, {"lang": "en", "type": "remediation developer", "value": "Fiona Morrison (fionamorrison23)"}, {"lang": "en", "type": "remediation developer", "value": "Suchi Garg (gargsuchi)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Richard Gaunt (richardgaunt)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/civictheme", "vendor": "Drupal", "product": "CivicTheme Design System", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.12.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/civictheme", "defaultStatus": "unaffected"}], "datePublic": "2025-10-22T16:35:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-113"}], "x_generator": {"engine": "Vulnogram 0.4.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).<p>This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-10-29T23:14:33.900Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12083", "state": "PUBLISHED", "dateUpdated": "2025-10-30T14:40:11.746Z", "dateReserved": "2025-10-22T16:06:23.591Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-10-29T23:14:33.900Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}