CVE-2025-11884 - CVE House
Back to Database
Status published Low CVE-2025-11884

Cross-site Scripting vulnerability discovered in OpenText™ Universal Discovery and CMDB

Vulnerability Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in opentext uCMDB allows Stored XSS. The vulnerability could allow an attacker has high level access to UCMDB to create or update data with malicious scripts This issue affects uCMDB: 24.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-11884

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Mateusz "MaTTallica" Klement

References

More from OpenText™

View All →
CVE-2025-9208
Stored-XSS vulnerability discovered in OpenText WSM Management Server.
High 7.5
CVE-2025-9120
RCE vulnerability has been discovered in OpenText™ Carbonite Safe Server Backup.
High 8.6
CVE-2025-8055
SSRF vulnerability have been discovered in OpenText™ XM Fax
Medium 5.3
CVE-2025-8054
Path Traversal vulnerability have been discovered in OpenText™ XM Fax.
High 7.1
CVE-2025-3476
Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability...
Critical 9.4

Affected Vendor

OpenText™

View all reports →

Affected Software

uCMDB
Vulnerable Versions:
24.4

Timeline

Official Publish: November 19th, 2025
Last Modified: November 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact