CVE-2025-54057

Published Nov 27, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54057 is a stored cross-site scripting (XSS) vulnerability found in Apache SkyWalking versions up to and including 10.2.0. It stems from the improper neutralization of script-related HTML tags in a web page. This allows attackers to inject malicious code directly into the application, which is then stored and executed when other users access the affected page. The injected scripts run within users' browsers with the same privileges as legitimate application code. By exploiting this flaw, attackers could steal sensitive information like login credentials, session tokens, and personal data. They could also impersonate legitimate users, gain unauthorized access to accounts, and potentially compromise the entire application and its underlying data infrastructure. Version 10.3.0 addresses the vulnerability.

Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10.2.0. Users are recommended to upgrade to version 10.3.0, which fixes the issue.
Source: security@apache.org
NVD status: Analyzed
Products: skywalking

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

security@apache.org: CWE-80

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:skywalking:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "802C6A2F-36AC-40A6-AE35-9BD58BFC462A",
            "versionEndExcluding": "10.3.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.