Listen to this Post
How the CVE Works
CVE-2025-54392 is a stored Cross-Site Scripting (XSS) vulnerability in Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 through 11.1.25162.02. The flaw occurs when the application fails to sanitize authentication error messages before displaying them to users. An attacker can craft malicious input (e.g., via failed login attempts) that persists in the system. When an administrator views the error logs or authentication reports, the injected script executes in their browser session, potentially leading to session hijacking, unauthorized actions, or data theft.
DailyCVE Form
Platform: Netwrix Directory Manager
Version: 11.0.0.0 – 11.1.25162.02
Vulnerability: Stored XSS
Severity: Medium
Date: 08/11/2025
Prediction: Patch expected by 09/15/2025
What Undercode Say
Check vulnerable version
Get-WmiObject Win32_Product | Where-Object { $_.Name -like "Netwrix Directory Manager" }
Exploit PoC (simulated malicious input)
curl -X POST "https://[bash]/auth" -d "user=<script>alert('XSS')</script>&pass=random"
How Exploit
1. Attacker submits malicious script in login fields.
2. Script persists in error logs.
3. Admin views logs, triggering execution.
Protection from this CVE
- Update to version 11.1.25162.03 or later.
- Implement input sanitization for error messages.
- Enable CSP headers to mitigate XSS impact.
Impact
- Session hijacking.
- Unauthorized admin actions.
- Data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
