CVE-2025-13672: OpenText Web Site Management XSS Flaw

CVE-2025-13672 Overview

CVE-2025-13672 is a Reflected Cross-Site Scripting (XSS) vulnerability in OpenText™ Web Site Management Server. The vulnerability allows attackers to inject malicious JavaScript code into URL parameters, which is then rendered within the page preview functionality. When executed, the malicious scripts run on the client side, potentially compromising user sessions and sensitive data.

Critical Impact

Attackers can execute arbitrary JavaScript in the context of authenticated user sessions, potentially leading to session hijacking, credential theft, or further attacks against enterprise content management infrastructure.

Affected Products

• OpenText™ Web Site Management Server 16.7.0
• OpenText™ Web Site Management Server 16.7.1

Discovery Timeline

• 2026-02-19 - CVE CVE-2025-13672 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-13672

Vulnerability Analysis

This vulnerability stems from improper neutralization of user-supplied input during web page generation (CWE-79). The Web Site Management Server fails to adequately sanitize URL parameters before including them in the page preview functionality. This allows an attacker to craft malicious URLs containing JavaScript payloads that execute when a victim accesses the manipulated link.

The attack requires user interaction, as the victim must click on or navigate to a specially crafted URL. The attacker must have low-level privileges on the system to exploit this vulnerability. When successful, the attack can result in high confidentiality impact on the vulnerable system, as well as high confidentiality impact on subsequent systems, indicating the potential for cross-system compromise.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the Web Site Management Server's page preview functionality. URL parameters are processed and reflected back to users without proper sanitization, allowing malicious script content to be interpreted as executable code by the victim's browser. The application fails to implement adequate context-aware output encoding when rendering user-controlled data in HTML responses.

Attack Vector

The attack is network-based and targets the page preview functionality of OpenText Web Site Management Server. An attacker crafts a malicious URL containing JavaScript code embedded within URL parameters. When a legitimate user clicks on this URL or is redirected to it through social engineering techniques, the server reflects the malicious content back to the browser without proper sanitization.

The malicious JavaScript then executes within the security context of the vulnerable application, giving the attacker access to session cookies, authentication tokens, and the ability to perform actions on behalf of the victim. This reflected XSS attack is particularly dangerous in enterprise content management environments where administrative users may have elevated privileges.

Detection Methods for CVE-2025-13672

Indicators of Compromise

• Unusual URL parameters containing encoded JavaScript content such as <script>, javascript:, or event handlers like onerror, onload
• Web server logs showing requests with URL-encoded script tags or JavaScript functions in query strings
• Browser-side detection of unexpected script execution originating from the Web Site Management Server domain
• User reports of unexpected behavior or redirects when accessing preview functionality

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in URL parameters
• Deploy Content Security Policy (CSP) headers to restrict script execution sources and detect violations
• Enable detailed access logging on the Web Site Management Server and monitor for suspicious URL patterns
• Utilize browser-based XSS auditing and reporting mechanisms to capture exploitation attempts

Monitoring Recommendations

• Monitor web server access logs for URL parameters containing script tags, event handlers, or JavaScript URI schemes
• Implement real-time alerting for CSP violation reports indicating potential XSS exploitation
• Track and investigate any unusual patterns in page preview functionality access
• Review authentication logs for signs of session hijacking following potential XSS attacks

How to Mitigate CVE-2025-13672

Immediate Actions Required

• Review the OpenText Knowledge Base Article for vendor-specific remediation guidance
• Apply any available security patches from OpenText for Web Site Management Server versions 16.7.0 and 16.7.1
• Implement Content Security Policy headers to restrict inline script execution
• Consider temporarily restricting access to the page preview functionality until patches are applied

Patch Information

OpenText has published security guidance for this vulnerability. Administrators should consult the OpenText Knowledge Base Article for detailed patch information and remediation steps specific to their deployment.

Workarounds

• Deploy a Web Application Firewall (WAF) with XSS protection rules to filter malicious input in URL parameters
• Implement strict Content Security Policy headers including script-src 'self' to prevent inline script execution
• Restrict access to the page preview functionality to trusted internal networks only
• Educate users about the risks of clicking on untrusted links, especially those targeting the Web Site Management Server

# Example Content Security Policy header configuration for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"