Executive brief
DivvyDrive Digital Corporate Warehouse, a platform used for corporate data storage and management, is affected by a security vulnerability that allows attackers to inject malicious scripts into the system. If an authorized user views the affected content, the attacker could potentially steal session information or perform unauthorized actions on behalf of that user. This could lead to unauthorized access to sensitive corporate documents and data.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in DivvyDrive Digital Corporate Warehouse before version 4.8.2.22. The flaw stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where the application fails to properly sanitize user-supplied input before storing it and displaying it to other users. An authenticated attacker with low privileges can inject malicious JavaScript into the application's database. When a victim (such as an administrator) views the compromised page, the script executes in their browser context, potentially allowing for session hijacking or unauthorized data exfiltration. The vulnerability is addressed in version 4.8.2.22.
Affected products
- DivvyDrive Information Technologies Inc. Digital Corporate Warehouse before v.4.8.2.22
Timeline
- 2025-11-12: advisory: Initial publication of CVE-2025-11962 by TR-CERT
- 2025-11-12: disclosed