CVE-2025-56320 identifies a stored XSS vulnerability in CobbleStone Enterprise Contract Management Portal version 22.4.0, specifically in the chat box feature. This vulnerability permits remote attackers with low privileges to inject malicious scripts that execute in the context of other users, potentially leading to code execution. The supplier has confirmed that this version is obsolete and unsupported, implying no active patch or fix is available for this version. There are no known exploits in the wild reported.

Successful exploitation could allow an attacker to execute arbitrary code in the context of the affected application, potentially leading to information disclosure or user session compromise. However, the impact is limited by the requirement of low privileges and user interaction (UI:R). The affected version is no longer supported or in circulation, reducing the practical risk.

Since the affected version 22.4.0 is obsolete and unsupported, the supplier does not provide a patch or fix. Users should upgrade to a supported, updated version of the software where this vulnerability is presumably addressed. If upgrading is not immediately possible, restricting access to the chat box component or disabling it may reduce exposure.