EUVD-2025-209589Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PR:L assessed because 'user information parameter' in a cloud management platform most plausibly requires authenticated access; all other metrics retained from provided vector.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the user information parameter.
AnalysisAI
Stored cross-site scripting in OpenNebula 6.10.0.1 allows attackers to inject persistent malicious scripts via the user information parameter, which subsequently execute in the browsers of any user who views the affected content. The scope change in the CVSS vector (S:C) reflects that execution escapes the application's trust boundary into victims' browser sessions, enabling session hijacking or unauthorized UI actions. A proof-of-concept is publicly available on GitHub (SSVC confirms exploitation status as poc), though EPSS at 0.03% (8th percentile) and SSVC's non-automatable classification indicate this has not seen broad opportunistic exploitation.
Technical ContextAI
OpenNebula is an open-source cloud computing management platform (CPE: cpe:2.3:a:opennebula:opennebula:*:*:*:*:*:*:*:*) used to orchestrate virtual infrastructure across private and hybrid clouds. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the application fails to sanitize or encode attacker-controlled input before persisting it in storage and subsequently rendering it in other users' browser sessions. The attack surface is the user information parameter - a data field in the web management interface - where an attacker can embed a crafted HTML or JavaScript payload that is stored server-side and replayed to any user who views that data, including administrators. This stored variant is more dangerous than reflected XSS because the payload persists and triggers without requiring the victim to follow a crafted link.
RemediationAI
The primary recommended action is to upgrade to OpenNebula 7.x based on the reference to the OpenNebula 7 release at https://opennebula.io/opennebula-7/; however, a patched version is not independently confirmed as a formal security fix for this CVE, so administrators should verify with the vendor advisory or release notes before treating v7 as a confirmed remediation. If immediate upgrade is not feasible, the most actionable compensating control is to restrict write access to the user information parameter: limit the ability to modify user profile fields to authenticated, trusted roles only and deny self-service profile editing for untrusted or external users - this trades usability for attack surface reduction. Additionally, deploying a web application firewall (WAF) with XSS filtering rules on the OpenNebula Sunstone web interface can intercept known payload patterns, though WAF bypass is possible with encoding variations. Content Security Policy (CSP) headers enforcing a strict script-src directive would limit the impact of any stored payload that does execute. Consult VulDB advisory https://vuldb.com/vuln/360178 and the upstream GitHub reference https://github.com/MarkArtamonov/OpenNebula-CVE-2025-56536 for technical detail on the injection point.
More in Opennebula
View allImproper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebu
Broken authorization in OpenNebula's `one.vm.exec` API function allows any authenticated low-privilege user to execute a
Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery. Rated me
Stored cross-site scripting in OpenNebula v6.10.0.1 allows an attacker to persist a malicious payload inside the virtual
Reflected cross-site scripting in OpenNebula 6.10.0.1 allows unauthenticated remote attackers to inject arbitrary JavaSc
Cross-site scripting in OpenNebula v6.10.0.1's custom authenticator driver enables unauthenticated remote attackers to i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today