SUSE Manager Server CVE-2025-53883

Exploitation requires an authenticated SUSE Manager web UI victim (CVSS PR:L) to be socially engineered into opening an attacker-crafted link that injects unneutralized script into one of the product's search fields, and the attack only fires when that victim's browser renders the reflected response (CVSS UI:P - passive user interaction). Limiting factors: the payload is not persistent, so each victim must be individually induced to load the malicious URL; the attack executes with only the victim's privileges; and it is confined to the affected SUSE Manager Server builds prior to 5.0.28-150600.3.36.8 (container suse/manager/5.0) and 4.3.88-150400.3.113.5 (SUSE Manager Server LTS 4.3).

This is a reflected (Basic) XSS vulnerability (CWE-80) in the search fields of SUSE Manager Server and SUSE Manager Server LTS 4.3. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H, base 9.3) indicates a network-reachable, low-complexity attack that requires low privileges (PR:L - authenticated) and passive user interaction (UI:P), with high confidentiality/integrity impact on both the vulnerable and a subsequent system. The very high 9.3 score is driven largely by the high vulnerable- and subsequent-system impact ratings SUSE assigned, which is plausible for an XSS in a privileged systems-management console where a hijacked administrator session can translate into control over many managed hosts; however, 9.3 is unusually high for a reflected XSS and is sensitive to those impact assumptions. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Net assessment: a genuinely serious bug worth prompt patching because of the high-value target (an infrastructure management server) and network reach, but the reflected nature plus required user interaction and an authenticated context make it more consistent with targeted phishing-style exploitation than mass, automated attack - treat as high-priority patching, not an emergency on par with an unauthenticated RCE.

An attacker crafts a malicious URL containing JavaScript in a vulnerable search-field parameter of the SUSE Manager web UI and lures a logged-in operator or administrator into clicking it (e.g., via phishing). When the victim's browser renders the reflected, unneutralized input, the attacker's script executes in the victim's authenticated session, allowing session/token theft or actions performed as the victim within the management console. No public exploit code was identified at time of analysis; exploitation requires user interaction and an authenticated victim session.