Vulnerability Description
The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next').
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisa | Software Acquisition Guide | < 2025-12-11 |
Related Weaknesses (CWE)
References
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/Vendor Advisory
- https://www.cisa.gov/software-acquisition-guide/toolProduct
- https://www.cve.org/CVERecord?id=CVE-2025-67634Vendor Advisory
FAQ
What is CVE-2025-67634?
CVE-2025-67634 is a vulnerability with a CVSS score of 4.4 (MEDIUM). The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-craf...
How severe is CVE-2025-67634?
CVE-2025-67634 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-67634?
Check the references section above for vendor advisories and patch information. Affected products include: Cisa Software Acquisition Guide.