Repository navigation
[GHSA-fc9r-7hhq-7wqj] Add affected package EPiServer.CMS.UI < 12.32.0 (CVE-2025-22389) - #10692
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
The vendor-hosted NuGet package needs curator confirmation against the repository’s documented nuget.org registry scope.
1 open issue
What changed in this PR
This PR adds affected-package metadata for CVE-2025-22389 to the advisory database, linking the vulnerability to the CMS UI package identified in the quoted vendor guidance.
Changes:
- Adds
EPiServer.CMS.UIin the NuGet ecosystem. - Marks versions before
12.32.0as affected and records12.32.0as fixed.
| File | Description |
|---|---|
| advisories/unreviewed/2025/01/GHSA-fc9r-7hhq-7wqj/GHSA-fc9r-7hhq-7wqj.json | Adds the affected NuGet package and fixed-version boundary. |
Review effort: Max
| { | ||
| "package": { | ||
| "ecosystem": "NuGet", | ||
| "name": "EPiServer.CMS.UI" |
There was a problem hiding this comment.
Fixed: details now says EPiServer.CMS.UI before 12.32.0, matching the affected entry and the vendor advisory.
|
Thanks. Correct, I understand this may be outside the supported NuGet scope. If so, could the curators still accept the corrected |
Updates
Optimizely security advisory: CMS-2025-03 (CVE-2025-22389)
Comments
CVE-2025-22389 has no affected package, so Dependabot and
dotnet list package --vulnerabledon't report it to anyone using the vulnerable versions.Optimizely's advisory (https://support.optimizely.com/hc/en-us/articles/33182404079629-Content-Management-System-CMS-Security-Advisory-CMS-2025-03) names the affected package and the fix:
This PR:
EPiServer.CMS.UIwith the range< 12.32.0(published on the Optimizely NuGet feed, https://nuget.optimizely.com/feed/packages.svc/)WEBtoADVISORY, since it is the vendor's official advisoryPACKAGEreferenceThe current
detailstext comes from NVD and says "EPiServer.CMS.Core before 12.32.0". That doesn't match the vendor advisory:EPiServer.CMS.Corehas no 12.32.x release (its latest 12.x is 12.24.3), so the affected package isEPiServer.CMS.UI.🤖 Generated with Claude Code