CVE-2025-67842

MEDIUM

6.4

Descricao

The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomain parameter because any tenant's assets can be served on any other tenant's documentation site.

Detalhes CVE

Pontuacao CVSS v3.16.4

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado12/19/2025

Ultima modificacao1/2/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

mintlify:mintlify

Fraquezas (CWE)

CWE-829

Referencias

https://gist.github.com/hackermondev/5e2cdc32849405fff6b46957747a2d28(cve@mitre.org)

https://heartbreak.ing(cve@mitre.org)

https://kibty.town/blog/mintlify/(cve@mitre.org)

https://news.ycombinator.com/item?id=46317098(cve@mitre.org)

https://www.mintlify.com/blog/working-with-security-researchers-november-2025(cve@mitre.org)

https://www.mintlify.com/docs/changelog(cve@mitre.org)

https://kibty.town/blog/mintlify/(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.