An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.
References
| Link | Resource |
|---|---|
| https://korelogic.com/Resources/Advisories/KL-001-2025-012.txt | Exploit Third Party Advisory |
| https://xormon.com/note190.php | Release Notes |
| http://seclists.org/fulldisclosure/2025/Jul/15 |
Configurations
History
03 Nov 2025, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2025-07-29 00:15
Updated : 2025-11-03 20:19
NVD link : CVE-2025-54766
Mitre link : CVE-2025-54766
CVE.ORG link : CVE-2025-54766
JSON object : View
Products Affected
xorux
- xormon
CWE
CWE-648
Incorrect Use of Privileged APIs