CVE-2025-3478: OpenText Enterprise Security Manager XSS

CVE-2025-3478 Overview

CVE-2025-3478 is a stored Cross-Site Scripting (XSS) vulnerability identified in OpenText Enterprise Security Manager (ESM). An authenticated attacker can inject malicious script content that the application persists and later renders to other users of the platform. Because ESM is a Security Information and Event Management (SIEM) console used by analysts and administrators, successful exploitation can compromise high-privilege sessions and pivot into broader security operations workflows. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). It is remotely exploitable over the network and requires user interaction for the stored payload to execute.

Critical Impact
A low-privileged remote attacker can store JavaScript payloads in OpenText ESM that execute in the browsers of other authenticated users, enabling session hijacking, configuration tampering, and access to SIEM data.

Affected Products

OpenText Enterprise Security Manager (ESM)
Micro Focus ArcSight ESM (legacy branding referenced in vendor advisory)
Web management console of OpenText ESM exposed to authenticated users

Discovery Timeline

2025-08-25 - CVE-2025-3478 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3478

Vulnerability Analysis

The vulnerability is a stored XSS flaw in OpenText Enterprise Security Manager. The application accepts user-controlled input through one or more web console fields and stores that input without performing sufficient output encoding when it is later rendered in HTML responses. When another user views the affected view, the injected script executes within the trusted origin of the ESM console.

ESM is used by Security Operations Center (SOC) analysts and administrators, so an injected payload runs with the privileges of a security operator. Attackers can use this to read or exfiltrate session tokens, submit authenticated requests on behalf of the victim, manipulate dashboards and rules, and modify alert content shown to other analysts. The persistence of the payload increases impact because every analyst who views the affected resource is exposed.

Root Cause

The root cause is improper neutralization of input during web page generation, as described by CWE-79. User-supplied data is written to a persistent store and later included in HTML output without context-appropriate escaping. The renderer treats the stored characters as markup rather than as text, allowing <script> tags or event-handler attributes to execute in the victim's browser.

Attack Vector

The attack vector is network-based and requires authentication at a low privilege level plus user interaction. An attacker with a valid ESM account submits a malicious payload through a field that is stored and later rendered. When a higher-privileged user, such as an administrator, navigates to the affected page, the script executes in their session. The vendor advisory hosted at the Micro Focus Knowledge Article provides product-specific details on the affected components.

No verified public proof-of-concept code is currently associated with this CVE. The vulnerability mechanism follows the standard stored XSS pattern: malicious markup is submitted, persisted in backend storage, and reflected without sanitization in subsequent HTTP responses.

Detection Methods for CVE-2025-3478

Indicators of Compromise

HTTP request bodies or query parameters submitted to OpenText ESM containing <script>, javascript:, onerror=, onload=, or encoded variants such as %3Cscript%3E.
Stored records or audit log entries in ESM containing HTML or JavaScript syntax in fields that should hold plain text.
Outbound HTTP requests from analyst workstations to unfamiliar domains immediately after rendering ESM pages, suggesting payload exfiltration.
Unexpected configuration, rule, or user changes performed under an administrator account that did not initiate the action.

Detection Strategies

Inspect ESM web access logs for POST and PUT requests whose payloads contain HTML tags or known XSS keywords in fields that should be alphanumeric.
Correlate analyst browser telemetry with ESM page loads to identify script execution that does not originate from vendor-supplied assets.
Apply Content Security Policy (CSP) violation reporting at the browser to surface inline script execution attempts within the ESM origin.

Monitoring Recommendations

Forward ESM application and web server logs to a centralized SIEM and alert on input fields containing HTML control characters such as <, >, and ".
Monitor administrator account activity for session-token reuse from unexpected IP addresses, which can indicate token theft via XSS.
Track configuration changes, new user creations, and rule modifications in ESM and require out-of-band confirmation for high-impact actions.

How to Mitigate CVE-2025-3478

Immediate Actions Required

Apply the vendor-supplied patch referenced in the Micro Focus Knowledge Article KM000042483 for OpenText Enterprise Security Manager.
Restrict access to the ESM web console to trusted management networks using firewall or VPN controls until patching is verified.
Audit existing ESM records for stored HTML or JavaScript content and remove any unauthorized entries.
Force a password reset and invalidate active sessions for all ESM users after remediation to revoke any stolen tokens.

Patch Information

OpenText has published guidance for this issue through its support portal. Administrators should consult the Micro Focus Knowledge Article KM000042483 for the fixed versions and upgrade procedures applicable to their deployment. Apply the patch in a maintenance window and validate that the affected input fields properly encode user-supplied content after the upgrade.

Workarounds

Enforce a strict Content Security Policy on the ESM web console to block inline script execution and untrusted script sources.
Limit ESM account creation and reduce the number of low-privileged accounts that can submit content to fields exposed in shared views.
Require analysts to use dedicated browsers or isolated browsing profiles when accessing ESM to limit cross-site token exposure.
Configure web application firewall (WAF) rules to inspect and block requests to ESM containing HTML or script syntax in non-HTML fields.

bash

# Example WAF rule snippet (ModSecurity) to block suspicious payloads to ESM
SecRule REQUEST_URI "@beginsWith /arcsight/" \
    "id:1003478,phase:2,deny,status:403,log,\
     msg:'Potential XSS payload targeting OpenText ESM (CVE-2025-3478)',\
     chain"
    SecRule ARGS|REQUEST_BODY "@rx (?i)(<script|javascript:|onerror=|onload=)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"