CVE-2025-24530

What it actually does

Cross-site scripting flaw in the check tables feature allows injection of arbitrary scripts via crafted table or database names, enabling execution in other users' browsers with limited confidentiality and integrity impact across security contexts.

Why it matters to the business

Potential exposure of user sessions or unauthorized actions within database administration interfaces across Red Hat service mesh deployments, increasing risk of data leakage; low and stable EPSS with no KEV listing and over 600 days since publication indicates limited active exploitation but still requires patching of affected packages to prevent opportunistic abuse.

How an attack unfolds

An attacker with low-privileged access crafts a table or database name containing malicious script payloads and triggers the check tables feature; when a victim user interacts with the feature, the payload executes in their browser session.

How to fix it

Upgrade all affected Red Hat service mesh packages to the listed fixed versions: servicemesh, servicemesh-citadel, servicemesh-galley, servicemesh-istioctl, servicemesh-mixc, servicemesh-mixs, servicemesh-pilot-agent, servicemesh-pilot-discovery, and servicemesh-sidecar-injector to 0:1.1.17-3.el8; servicemesh-proxy to 0:1.1.17-2.el8.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases using package manager queries; test the check tables feature with sample objects to confirm absence of script execution.

Typical attack path

1. Identify accessible phpMyAdmin instance within affected Red Hat service mesh environment
2. Create or rename a table or database using a name embedding JavaScript or HTML payload
3. Trigger the check tables feature for the malicious object
4. Wait for or lure a victim user to view or interact with the object
5. Execute injected script to steal cookies, redirect, or perform actions on behalf of the victim

How to detect it

Search web server and application logs for requests containing suspicious characters in table or database name parameters around the check tables functionality; inspect browser-side artifacts or proxy logs for unexpected script execution originating from administrative interfaces.

What your security team should do

• Prioritize upgrade of all listed Red Hat service mesh packages to the specified fixed versions
• Review and restrict low-privileged access to phpMyAdmin interfaces
• Implement web application firewall rules to sanitize database object names
• Monitor application logs for unusual table or database name patterns