CVE-2025-67223

HIGH EPSS 45.7%

Published Apr 28, 20262mo ago · Modified Jun 17, 20261w ago

7.5 CVSS 3.1

High

Published Apr 28, 2026 2mo ago

Last Modified Jun 17, 2026 1w ago

Description

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

45.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-377

CWE-532

References 3

arandasoft.com https://arandasoft.com/en/productos/aranda-service-management/
docs.arandasoft.com https://docs.arandasoft.com/at-v8-release-notes/en/pages/release_pdf/file_server.html
github.com https://github.com/brandonperezlara/CVE-2025-67223

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.