CVE-2025-40649 PUBLISHED

Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC

Assigner: INCIBE
Reserved: 16.04.2025 Published: 07.10.2025 Updated: 07.10.2025

Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using parameter text in '/api/v3/negotiations/<postUID>/posts'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS Score: 5.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	Low
Attack Complexity	Low	Integrity	None	Integrity	Low
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	BBMRI-ERIC
Product	Negotiator
Versions	Default: unaffected affected from 0 to 3.15.5 (excl.)

Solutions

The vulnerability has been fixed by the BBMRI-ERIC team in version 3.15.5.

Credits

Erlaitz Parreño Muñoz finder

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bbmri-eric-negotiator

Problem Types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CWE