N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2mx6-fq24-g2mh

GHSA-2mx6-fq24-g2mh: ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

Impact

This security advisory resolves an XSS vulnerability in image asset names, content language names and future publishing in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

Patches

See "Patched versions".

Workarounds

None.

References

https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2mx6-fq24-g2mh

GHSA-2mx6-fq24-g2mh:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ibexa/admin-ui	composer	>= 5.0.0, < 5.0.3	5.0.3
ibexa/admin-ui	composer	>= 4.6.0, < 4.6.25	4.6.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided vulnerability information, which indicated XSS vulnerabilities in ibexa/admin-ui. The affected version ranges are >= 5.0.0, < 5.0.3 and >= 4.6.0, < 4.6.25. I identified the commits between the last vulnerable version and the first patched version for both ranges.

Within the commit history, two commits with security-related messages were found: da3bfbfbc47d322cf052b14bf609858b6ddee5c7 and 2016a6933e3f3c7aa0993613a099b6ad6cbc6b45.

Commit da3bfbfbc47d322cf052b14bf609858b6ddee5c7 titled "[Security] IBX-10200: Fix XSS in reschedule/cancel-schedule modal" modified src/bundle/Resources/public/js/scripts/fieldType/ezimageasset.js. The change replaced a call to .innerHTML with .innerText when setting an asset name. This is a classic XSS fix, preventing unsanitized input from being rendered as HTML. The vulnerable code is located in an anonymous event handler function.
Commit 2016a6933e3f3c7aa0993613a099b6ad6cbc6b45 titled "IBX-10286: Fix Multilevel Popup Menu XSS" modified src/bundle/Resources/public/js/scripts/core/multilevel.popup.menu.js. The patch added HTML escaping to the label and sublabel parameters within the _renderItem method of the MultilevelPopupMenu class. This prevents malicious input from being rendered as HTML in popup menus.

These two commits directly address the types of XSS vulnerabilities described in the advisory and are present in the patch releases for both affected version branches. The identified functions are therefore the locations where the vulnerabilities existed and were fixed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-2mx6-fq24-g2mh: ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

Impact

Patches

Workarounds

References

GHSA-2mx6-fq24-g2mh:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

GHSA-2mx6-fq24-g2mh: ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

Impact

Patches

Workarounds

References

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI