CVE-2025-34114 Information

Description

A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments due to the absence of critical HTTP response headers including Content-Security-Policy Referrer-Policy Permissions-Policy Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy. This omission weakens browser-level defenses and exposes users to cross-site scripting (XSS) clickjacking and referer leakage. Although some instances attempt to enforce CSP via HTML tags this method is ineffective as modern browsers rely on header-based enforcement to reliably block inline scripts and untrusted resources.

Reference

https://seclists.org/fulldisclosure/2025/Jul/13 https://www.openblow.it https://www.vulncheck.com/advisories/openblow-missing-critical-security-headers

Related CNNVD

CNNVD-202507-3284 (Published: 2025-07-25)