CVE-2025-67223

{
  "id": "CVE-2025-67223",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-28T15:16:06.033",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII."
    },
    {
      "lang": "es",
      "value": "El componente Aranda Servidor de Archivos (AFS) en Aranda Software Aranda Service Desk antes de 8.3.12 almacena registros de actividad diarios con nombres predecibles en un directorio de acceso público, lo que permite a atacantes remotos no autenticados obtener rutas virtuales directas de archivos cargados y eludir los controles de acceso para descargar documentos sensibles que contienen PII."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-28T15:53:23.961090Z",
          "id": "CVE-2025-67223",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-377"
        },
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://arandasoft.com/en/productos/aranda-service-management/",
      "source": "[email protected]"
    },
    {
      "url": "https://docs.arandasoft.com/at-v8-release-notes/en/pages/release_pdf/file_server.html",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/brandonperezlara/CVE-2025-67223",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/brandonperezlara/CVE-2025-67223",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}