CVE-2025-1585 otale header.html OptionsService cross site scripting
Remote attackers can execute arbitrary scripts via the logo_url parameter in the header template of the unsupported tale application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-1585?
CVE-2025-1585 is a medium-severity cross-site scripting vulnerability in otale tale, published on 23 Feb 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability, which was classified as problematic, has been found in otale tale up to 2.0.5. This issue affects the function OptionsService of the file src/main/resources/templates/themes/default/partial/header.html. The manipulation of the argument logo_url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Which versions are affected by CVE-2025-1585?
It affects 1 product.
Products include Tale Project Tale.
How do I fix CVE-2025-1585?
No fix has been published for CVE-2025-1585 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-1585 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1585 exists.
Other vulnerabilities in otale tale
Sources
Also known as GHSA-cv9w-4qgc-5w82.