Listen to this Post
How the CVE Works
CVE-2025-54395 is a stored Cross-Site Scripting (XSS) vulnerability in Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 through 11.1.25162.02. The flaw exists in the authentication configuration data handling, where malicious input is not properly sanitized before being rendered in the web interface. An attacker with administrative privileges can inject arbitrary JavaScript payloads, which execute when another administrator views the affected configuration page. This could lead to session hijacking, unauthorized actions, or data theft.
DailyCVE Form
Platform: Netwrix Directory Manager
Version: 11.0.0.0 – 11.1.25162.02
Vulnerability: Stored XSS
Severity: Medium
Date: 08/11/2025
Prediction: Patch expected by 09/15/2025
What Undercode Say
Check version
Get-WmiObject Win32_Product | Where-Object {$_.Name -like "Netwrix Directory Manager"} | Select Version
Exploit PoC (simulated)
curl -X POST -d "config=<script>alert('XSS')</script>" http://target/admin/config
How Exploit
1. Authenticate as admin.
2. Inject malicious script in auth config.
3. Trigger execution via admin panel access.
Protection from this CVE
- Update to version 11.1.25162.03 or later.
- Sanitize admin input fields.
- Implement CSP headers.
Impact
- Session hijacking.
- Unauthorized admin actions.
- Data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
