CVE-2025-20049 (GCVE-0-2025-20049)
Vulnerability from cvelistv5
Published
2025-02-28 17:04
Modified
2025-02-28 21:48
Severity ?
5.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
7.1 (High) - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
CWE
  • CWE-79 - Cross-site Scripting
Summary
The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information.
References
Impacted products
Vendor Product Version
Dario Health Dario Application Database and Internet-based Server Infrastructure Version: All versions
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20049",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-28T21:48:07.239321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-28T21:48:28.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Dario Application Database and Internet-based Server Infrastructure",
          "vendor": "Dario Health",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noah Cutler and Manuel Del Rio of Accenture reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information.\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T17:13:18.822Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01"
        },
        {
          "url": "https://www.dariohealth.com/contact/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDario Health recommends users update their Dario Health Android mobile application to the latest version. No other actions are required by users.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Dario Health recommends users update their Dario Health Android mobile application to the latest version. No other actions are required by users."
        }
      ],
      "source": {
        "advisory": "ICSMA-25-058-01",
        "discovery": "EXTERNAL"
      },
      "title": "Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site Scripting",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDario Health recommends users perform the following mitigations:\u0026nbsp; \u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eUpdate the application from trusted sources.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\u003cli\u003eDon\u0027t use rooted/jailbroken devices.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\u003cli\u003eAvoid public untrusted network.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\u003cli\u003eFor more information \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.dariohealth.com/contact/\"\u003econtact Dario Health\u003c/a\u003e\u0026nbsp;directly.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Dario Health recommends users perform the following mitigations:\u00a0 \n\n\n  *  Update the application from trusted sources.\u00a0 \n\n  *  Don\u0027t use rooted/jailbroken devices.\u00a0 \n\n  *  Avoid public untrusted network.\u00a0 \n\n  *  For more information  contact Dario Health https://www.dariohealth.com/contact/ \u00a0directly."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2025-20049",
    "datePublished": "2025-02-28T17:04:11.352Z",
    "dateReserved": "2025-01-27T21:33:08.440Z",
    "dateUpdated": "2025-02-28T21:48:28.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-20049\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2025-02-28T17:15:16.277\",\"lastModified\":\"2025-02-28T17:15:16.277\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information.\"},{\"lang\":\"es\",\"value\":\"La aplicaci\u00f3n de servicio del portal Dario Health es vulnerable a XSS, lo que podr\u00eda permitir a un atacante obtener informaci\u00f3n confidencial.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.3,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.dariohealth.com/contact/\",\"source\":\"ics-cert@hq.dhs.gov\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Dario Application Database and Internet-based Server Infrastructure\", \"vendor\": \"Dario Health\", \"versions\": [{\"status\": \"affected\", \"version\": \"All versions\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Noah Cutler and Manuel Del Rio of Accenture reported these vulnerabilities to CISA.\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThe Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information.\u003c/span\u003e\\n\\n\u003c/span\u003e\\n\\n\u003c/span\u003e\"}], \"value\": \"The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 5.8, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"cvssV4_0\": {\"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"attackVector\": \"NETWORK\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"providerUrgency\": \"NOT_DEFINED\", \"subAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"subIntegrityImpact\": \"HIGH\", \"userInteraction\": \"ACTIVE\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-79\", \"description\": \"CWE-79 Cross-site Scripting\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2025-02-28T17:13:18.822Z\"}, \"references\": [{\"url\": \"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01\"}, {\"url\": \"https://www.dariohealth.com/contact/\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eDario Health recommends users update their Dario Health Android mobile application to the latest version. No other actions are required by users.\u003c/span\u003e\\n\\n\u003cbr\u003e\"}], \"value\": \"Dario Health recommends users update their Dario Health Android mobile application to the latest version. No other actions are required by users.\"}], \"source\": {\"advisory\": \"ICSMA-25-058-01\", \"discovery\": \"EXTERNAL\"}, \"title\": \"Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site Scripting\", \"workarounds\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003eDario Health recommends users perform the following mitigations:\u0026nbsp; \u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eUpdate the application from trusted sources.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\u003cli\u003eDon\u0027t use rooted/jailbroken devices.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\u003cli\u003eAvoid public untrusted network.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\u003cli\u003eFor more information \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.dariohealth.com/contact/\\\"\u003econtact Dario Health\u003c/a\u003e\u0026nbsp;directly.\u0026nbsp; \u003cbr\u003e\u003c/li\u003e\u003c/ul\u003e\\n\\n\u003cbr\u003e\"}], \"value\": \"Dario Health recommends users perform the following mitigations:\\u00a0 \\n\\n\\n  *  Update the application from trusted sources.\\u00a0 \\n\\n  *  Don\u0027t use rooted/jailbroken devices.\\u00a0 \\n\\n  *  Avoid public untrusted network.\\u00a0 \\n\\n  *  For more information  contact Dario Health https://www.dariohealth.com/contact/ \\u00a0directly.\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20049\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-28T21:48:07.239321Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-28T21:48:19.958Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-20049\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"icscert\", \"dateReserved\": \"2025-01-27T21:33:08.440Z\", \"datePublished\": \"2025-02-28T17:04:11.352Z\", \"dateUpdated\": \"2025-02-28T21:48:28.315Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.