| Titel | Governikus Software GmbH AusweisApp 2.5.4 Cross Site Scripting |
|---|
| Beschreibung | A vulnerability was found in Governikus AusweisApp up to 2.5.5. It has been rated as medium (5.3 with CVSS 4.0). The handling of the PAOS StartPAOS response message is affected by this vulnerability. The manipulation of the argument ResultMessage can lead to rendering of links and external images in the GUI. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised. This CVE was requested by the vendor.
The manipulation of the argument ResultMessage with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used for rendering the message to the user. Impacted is confidentiality. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1598.003 according to MITRE ATT&CK. This CVE was requested by the vendor.
Upgrading to version 2.6.0 eliminates this vulnerability. The update can be downloaded via Appstore/Playstore or ausweisapp.bund.de. |
|---|
| Benutzer | governikus (UID 100539) |
|---|
| Einreichung | 14.10.2026 11:12 (vor 29 Tagen) |
|---|
| Moderieren | 12.11.2026 16:26 (29 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 436402 [Governikus AusweisApp Mobile bis 2.5.5 StartPAOSResponse ResultMessage Cross Site Scripting] |
|---|
| Punkte | 17 |
|---|