CVE-2025-34413

Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deployments omit Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy (with CSP delivered via HTML meta elements being inadequate). The absence of these headers weakens browser-side defenses and increases exposure to client-side attacks such as cross-site scripting, clickjacking, referer leakage, and cross-origin data disclosure.

CVSS

No CVSS.

References

Link	Resource
https://seclists.org/fulldisclosure/2025/Dec/0
https://www.digitalpa.net/en/whistleblowing-software-features/
https://www.vulncheck.com/advisories/legality-whisteblowing-missing-critical-http-security-headers

Configurations

No configuration.

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Legality WHISTLEBLOWING de DigitalPA contiene un fallo en el mecanismo de protección en el que los encabezados de seguridad HTTP críticos no se emiten por defecto. Las implementaciones afectadas omiten Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy y Cross-Origin-Resource-Policy (siendo inadecuado que la CSP se entregue a través de elementos meta HTML). La ausencia de estos encabezados debilita las defensas del navegador y aumenta la exposición a ataques del lado del cliente como cross-site scripting, clickjacking, fuga de referer y divulgación de datos de origen cruzado.

Information

Published : 2025-12-09 18:15

Updated : 2026-10-08 10:10

NVD link : CVE-2025-34413

Mitre link : CVE-2025-34413

CVE.ORG link : CVE-2025-34413

JSON object : View

Products Affected

No product.

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-34413", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34413", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T19:20:48.580147Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "DigitalPA S.r.l.", "product": "Legality WHISTLEBLOWING", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-09T18:15:51.730", "references": [{"url": "https://seclists.org/fulldisclosure/2025/Dec/0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.digitalpa.net/en/whistleblowing-software-features/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/legality-whisteblowing-missing-critical-http-security-headers", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deployments omit Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy (with CSP delivered via HTML meta elements being inadequate). The absence of these headers weakens browser-side defenses and increases exposure to client-side attacks such as cross-site scripting, clickjacking, referer leakage, and cross-origin data disclosure."}, {"lang": "es", "value": "Legality WHISTLEBLOWING de DigitalPA contiene un fallo en el mecanismo de protecci\u00f3n en el que los encabezados de seguridad HTTP cr\u00edticos no se emiten por defecto. Las implementaciones afectadas omiten Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy y Cross-Origin-Resource-Policy (siendo inadecuado que la CSP se entregue a trav\u00e9s de elementos meta HTML). La ausencia de estos encabezados debilita las defensas del navegador y aumenta la exposici\u00f3n a ataques del lado del cliente como cross-site scripting, clickjacking, fuga de referer y divulgaci\u00f3n de datos de origen cruzado."}], "lastModified": "2026-10-08T10:10:00.227", "sourceIdentifier": "disclosure@vulncheck.com"}