CVE-2025-8386
AVEVA Application Server IDE Basic Cross-site Scripting
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The vulnerability can only be exploited during config-time operations within the IDE component of Application Server. Run-time components and operations are not affected.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 4.0 | High7.2 | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H |
| icscertCNA (assigner) | 3.1 | Medium6.9 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L |
| NVDNVD · Deferred | 4.0 | High7.2 | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Weakness
Affected products
- affected ≤ Versions 2023 R2 SP1 P02
What to do
Solution: AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users using affected product versions should apply security updates to mitigate the risk of exploit. All affected versions of the Application Server IDE can be fixed by upgrading to AVEVA System Platform 2023 R2 SP1 P03 https://softwaresupportsp.aveva.com/en-US/downloads/products/details/d32b2534-9601-4beb-ac78-046ca2ef594d or higher. The following general defensive measures are recommended: * Audit assigned permissions to ensure that only trusted users are added to the "aaConfigTools" OS Group. For additional information on Application Server OS Security groups and accounts, see https://docs.aveva.com/bundle/sp-install/page/738031.html For more information, see AVEVA's Security Bulletin AVEVA-2025-005 https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-005.pdf or AVEVA's bulletins page https://www.aveva.com/en/support-and-success/cyber-security-updates/ .
References (3)
- https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin-AVEVA-2025-005.pdf (opens in a new tab)
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-02 (opens in a new tab)
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-02.json (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-8386)Record last updated .