Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NSummary
CVE-2025-13979 is a medium-severity Privilege Defined With Unsafe Actions (CWE-267) vulnerability in Salsa.Digital Mini Site. Its CVSS base score is 5.4 (Medium).
Operationally, ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206442
Vulnerability Data
Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
- 10 hardening rules · 4 OS baselines
V13.2.2V3.7.3V9.2.2V9.2.3
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of all user-supplied input before storage, directly blocking the Stored XSS payload enabled by the unsafe privileged actions in Mini site <3.0.2.
Restricts the set of privileged actions that can be performed without additional checks, mitigating CWE-267 by ensuring the unsafe operations that led to stored script injection are not available to untrusted users.
Requires integrity verification of stored content and executable components, allowing detection of unauthorized script insertion that results from the privilege-defined unsafe actions vulnerability.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining and enforcing least-privilege permissions directly reduces the chance that a privilege permits unintended unsafe actions.
Secure SDLC practices directly target introduction of XSS via coding standards/testing (mostly), yet the single broad outcome leaves many specific neutralization vectors unaddressed (partial).
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of privileged utility programs restricts dangerous tools but does not address unsafe actions within assigned privileges.
Secure-coding testing and automated code-analysis tools are applied to detect improper neutralization of script-related content during web-page generation.
Access control policy can limit unsafe privilege use but does not define safe actions for each privilege.
Access rights assignment can restrict privileges to intended actions, yet does not guarantee the privilege itself is safe.
Segregation of duties reduces risk of unsafe actions by splitting privileges but does not address unsafe privilege definitions.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Ubuntu 22.04 (1 rule)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. via CWE-267
Ubuntu 24.04 (1 rule)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-267