diem-project diem XSS and Auth Flaws

Cryptographically weak pseudo-random number generation in the PHP CMS Diem's dmString::random() helper can produce predictable values that may undermine tokens or identifiers derived from it. All rolling-release versions through commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad are affected; the flaw is remotely reachable by unauthenticated attackers but rated high complexity (CVSS 2.9), with impact limited to low confidentiality. Publicly available exploit code exists, and the vendor has not responded or released a fixed version.

Improper certificate validation in the Google Analytics Client bundled with the Diem PHP framework (dmCorePlugin/lib/vendor/gapi/gapi.class.php) allows an attacker positioned on the network path between a Diem server and Google's Analytics endpoint to intercept or tamper with outbound analytics traffic without detection. Unauthenticated remote attackers can exploit this, but the attack requires a man-in-the-middle position and the vendor itself describes exploitability as difficult (CVSS 4.0 AC:H); impact is limited to low integrity of analytics data with no availability or confidentiality effect. Publicly available exploit code exists (referenced in diem-project/diem issue #454), and no vendor-released patch has been identified because the project has not responded and ships as a rolling release without versioned artifacts.

An open redirect in the Diem PHP framework's Sign-In component (dmCorePlugin dmUserPlugin) allows remote attackers to redirect users to arbitrary external sites after authentication by manipulating the Referer argument in BasedmUserActions.class.php. Exploitation is unauthenticated but requires the victim to follow a crafted link (UI:P), and the impact is limited to integrity of the redirect destination, with no server compromise or data disclosure. Publicly available exploit code exists, though no confirmed active exploitation has been reported; the vendor has not responded to the issue report and follows a rolling release model, so no fixed version is specified.

Cross-site scripting in the dmWidget link-rendering component of Diem CMS allows authenticated low-privilege users to inject script through the text argument of dmBaseLinkTag::text in dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php, with execution occurring in a victim's browser after the victim views or interacts with the crafted link. Deployments tracking Diem's rolling release at or before commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad are potentially affected, and publicly available exploit code exists; the reporter scores the issue CVSS 4.0 5.1, while the independent assessment places it at CVSS 3.1 5.4-equivalent impact with PR:L/UI:R. Exploitation is limited by the need for an authenticated account permitted to supply the widget's text argument and by the requirement for victim interaction.

Cross-site scripting in the Diem PHP CMS administrative console lets a user who already holds high-privilege console access inject script through the dm_command argument processed by the append() function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php, with the payload executing in the browser of a console operator who views the crafted page. Diem is delivered as a rolling release with no version metadata, so current checkouts at or around commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad remain unpatched, publicly available exploit code exists, and the project has not responded to the report. This is a low-to-moderate real-world priority despite the medium CVSS 4.0 base score of 4.8, because the vulnerable path sits behind high-privilege console authentication and the assessed impact is limited to low integrity with no confidentiality or availability effect.

Cross-site scripting in the Diem admin plugin's Version Check Service lets a high-privileged authenticated attacker supply markup that the html handler in dmAdminCtrl.js renders without proper escaping, executing script in a victim administrator's browser when the affected view is opened. The impact is limited to low integrity per the independent CVSS:3.1 assessment (C:N/I:L/A:N), and exploitation also requires victim interaction, so the issue is network-reachable but gated by administrative privileges and user action. Publicly available exploit code exists, but there is no CISA KEV confirmation and overall risk is low, especially because Diem uses a rolling release with no vendor-issued fixed version.