CVE-2025-37108 - Vulnerability Details - OpenCVE

Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Hpe	Telco Service Activator

No data.

No data.

References

Link	Providers
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US

History

Mon, 04 Aug 2025 09:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Hpe Hpe telco Service Activator
Vendors & Products		Hpe Hpe telco Service Activator

Thu, 31 Jul 2025 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-79
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 31 Jul 2025 19:45:00 +0000

Type	Values Removed	Values Added
Description	Cross-site scripting vulnerability have been identified in HPE Telco Service Activator product	Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product

Thu, 31 Jul 2025 19:30:00 +0000

Type	Values Removed	Values Added
Description		Cross-site scripting vulnerability have been identified in HPE Telco Service Activator product
Title		HPE Telco Service Activator, Protection Mechanism Failure
References		https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US
Metrics		cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: hpe

Published: 2025-07-31T19:17:55.861Z

Updated: 2025-07-31T19:50:02.995Z

Reserved: 2025-04-16T01:28:25.364Z

Link: CVE-2025-37108

Vulnrichment

Updated: 2025-07-31T19:49:12.743Z

NVD

Status : Awaiting Analysis

Published: 2025-07-31T20:15:32.357

Modified: 2025-08-04T15:06:36.623

Link: CVE-2025-37108

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-37108", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2025-04-16T01:28:25.364Z", "datePublished": "2025-07-31T19:17:55.861Z", "dateUpdated": "2025-07-31T19:50:02.995Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "HPE Telco Service Activator", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThan": "<10.3.2", "status": "affected", "version": "10.3.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product</span>"}], "value": "Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-07-31T19:21:36.177Z"}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US"}], "source": {"advisory": "HPESBNW04887", "discovery": "UNKNOWN"}, "title": "HPE Telco Service Activator, Protection Mechanism Failure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-31T19:49:02.307099Z", "id": "CVE-2025-37108", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-31T19:50:02.995Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37108", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-31T19:49:02.307099Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-31T19:49:12.743Z"}}], "cna": {"title": "HPE Telco Service Activator, Protection Mechanism Failure", "source": {"advisory": "HPESBNW04887", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Telco Service Activator", "versions": [{"status": "affected", "version": "10.3.0", "lessThan": "<10.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04887en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product</span>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-07-31T19:21:36.177Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37108", "state": "PUBLISHED", "dateUpdated": "2025-07-31T19:50:02.995Z", "dateReserved": "2025-04-16T01:28:25.364Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2025-07-31T19:17:55.861Z", "assignerShortName": "hpe"}, "dataVersion": "5.1"}