CVE-2026-25136highCWE-1004CWE-79

CVE-2026-25136: falha de alta gravidade em rucio

Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rucio+ Monitorar rucio-webui

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.3%
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
rucio · rucio
CVEs relacionadas — rucio

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58273HIGHRucio: Authorisation Bypass on REST API endpoint for signing URLsEPSS 0.6%CVE-2026-25138MEDIUMRucio WebUI has Username Enumeration via Login Error MessageEPSS 0.4%CVE-2026-25736MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE AttributeEPSS 0.3%CVE-2026-25735MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity NameEPSS 0.3%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.3%CVE-2026-25733HIGHRucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule FunctionEPSS 0.3%