CVE-2025-55888
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was found in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field, which is not properly sanitized or encoded when rendered, allowing script execution in users' browsers.
Risk Assessment
The risk includes session hijacking, cookie theft, and other malicious actions, potentially leading to data confidentiality breaches and system integrity compromise.
Recommendation
Immediately update ARD to the latest patched version and implement input validation and encoding for the accountName field.
Other vulnerabilities in ARD
Original NVD description (English source)
Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution in the context of users browsers. This flaw could lead to session hijacking, cookie theft, and other malicious actions.