Security readout for executives and security teams
Plain-English summary
This vulnerability can let an authenticated Umbraco CMS administrator run code on the server. It is high impact because successful abuse can compromise confidentiality, integrity, and availability, but it requires administrator privileges, so exposure is tied to admin account security and where the Umbraco backoffice is reachable.
Executive priority
Treat as a high-priority legacy CMS risk where affected Umbraco systems remain in use. The practical urgency is highest for internet-accessible administration portals or environments with weak admin credential controls.
Technical view
CVE-2019-25137 affects Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4. The flaw involves msxsl:script handling in an xsltSelection submitted to developer/Xslt/xsltVisualize.aspx, enabling remote code execution by an authenticated administrator. CVSS 3.1 is 7.2 with PR:H and no user interaction.
Likely exposure
Organizations running affected legacy Umbraco CMS versions are exposed if administrator credentials can access the vulnerable developer/XSLT functionality. Internet-reachable backoffice access increases business risk, especially after credential theft.
Exploitation context
The source bundle cites public exploit and PoC-style references, but does not include CISA KEV status or confirmed active exploitation. Abuse requires authenticated administrator access, so likely paths include malicious admins or compromised admin accounts.
Researcher notes
Affected product metadata in the bundle is incomplete, with vendor/product listed as n/a, but the description names Umbraco CMS versions. Patch details are not provided, so remediation should be validated against official vendor documentation.
Mitigation direction
- Inventory Umbraco CMS versions and identify systems in the affected version range.
- Check official Umbraco guidance before choosing upgrade or remediation actions.
- Restrict backoffice and developer interface access to trusted networks or VPN.
- Reduce administrator privileges and remove unused admin accounts.
- Review admin authentication controls, including MFA where supported.
Validation and detection
- Confirm production Umbraco versions against the affected range in the CVE record.
- Identify whether developer/Xslt/xsltVisualize.aspx is reachable by administrators.
- Audit administrator accounts for unnecessary access or recent suspicious changes.
- Review web and application logs for access to the vulnerable XSLT path.
- Check whether any mitigation or upgrade is documented by the vendor.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-91: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25137 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H1.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exploit-db.com/exploits/46153CVE reference
- https://github.com/noraj/Umbraco-RCECVE reference
- https://0xdf.gitlab.io/2020/09/05/htb-remote.htmlCVE reference
- https://github.com/Ickarah/CVE-2019-25137-Version-ResearchCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
XML Injection (aka Blind XPath Injection)
XML Injection (aka Blind XPath Injection) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.