Gdtaller EUVD-2025-209047

The CVSS 5.1 score reflects moderate risk with specific mitigating factors. The vector indicates network-based attack vector (AV:N), low complexity (AC:L), no privilege requirements (PR:N), and user interaction required (UI:A), meaning victims must click a malicious link. The scope is limited (SC:L), and impact is confined to session integrity and availability with no confidentiality breach (VC:N, VI:N, VA:N). CISA's SSVC framework indicates no confirmed exploitation, non-automatable delivery (requires user click), and only partial technical impact. Critically, no active exploitation (KEV status) and no public POC have been reported, significantly reducing real-world urgency compared to the raw CVSS score. Organizations should prioritize patching based on GDTaller's prominence in their environment and user exposure to untrusted links, rather than treating this as a critical incident.

An attacker crafts a malicious URL with JavaScript payload embedded in the 'site' parameter (e.g., app_login.php?site=<script>alert('XSS')</script> or site=javascript:fetch(...)) and sends it to a GDTaller user via phishing email, social engineering, or posting on forums. When the victim clicks the link while authenticated or considering logging in, the browser executes the attacker's script in the context of the GDTaller domain, potentially allowing session hijacking, credential theft, or malware injection. Because user interaction (clicking) is required and the attack is non-automatable, the real-world exploitation rate remains low despite network accessibility.