Auth bypass in Issuetrak Audit
CVE-2025-2271
A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference (IDOR) vulnerability in the Issuetrak audit component. The vulnerability enables unauthorized access to sensitive information, including user details, network and hardware information, installed programs, running processes, drives, and printers. Due to improper access controls, an attacker can retrieve audit data belonging to other users, potentially leading to unauthorized data exposure, privacy violations, and security risks.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Issuetrak Audit — versions Issuetrak 17.2.2 and prior
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-2271?
- CVE-2025-2271 is a high-severity vulnerability in Issuetrak Audit, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.7/10. Published 2025-03-13.
- How severe is CVE-2025-2271?
- High severity. CVSS v3 base score is 7.7 out of 10.