Oct8ne Chatbot CVE-2025-11952

Exploitation requires an attacker to inject a payload specifically during creation of a chat transcript that is subsequently distributed via the /Records/SendSummaryMail summary-email feature in Oct8ne Chatbot v2.3; the Records/SendSummaryMail transcript-to-email workflow must therefore be in use. Execution is limited by required user interaction (UI:P) - a victim (e.g., an agent or email recipient) must open or render the stored transcript/email in a browser for the script to fire - and impact is confined to the victim's browser session (session-cookie theft, actions on the user's behalf) with no direct impact on the server/application's own confidentiality, integrity, or availability (VC/VI/VA:N).

This is a medium-severity stored XSS (CVSS 4.0 base 5.3, CWE-79) with multiple signals pointing to limited real-world urgency rather than a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows network reach with low complexity and no privileges required (PR:N), but exploitation depends on passive user interaction (UI:P) and the direct vulnerable-system impact metrics are all None - the harm lands only on the subsequent system (the victim's browser), reflected in SC:L/SI:L. EPSS is low at 0.19% (8th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. Net assessment: a credible but modest-impact client-side flaw affecting a niche product; treat as a routine-patch item rather than an emergency. Note one tension to verify: PR:N implies the attacker can create the triggering transcript without authentication, yet transcript/summary-email generation (/Records/SendSummaryMail) often sits behind an operator or chat-session context - confirm with the vendor whether transcript creation is truly unauthenticated.

An attacker injects a malicious JavaScript payload while creating a chat transcript, which is then delivered through the /Records/SendSummaryMail summary-email function. When an operator or recipient opens or renders the resulting transcript/email in their browser, the stored payload executes, allowing theft of session cookies or actions performed on the victim's behalf. No public exploit code is identified, and successful execution requires the victim to view the crafted content (UI:P).