Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Aranda Service Desk Before 8.3.12 Leaks Sensitive Files

CVE-2025-67223 · published 6 months ago
Summary

If you're using Aranda Service Desk 8.3.12 or earlier, an attacker can access sensitive files by guessing the name of daily activity logs stored in a publicly accessible directory. This could expose personal information and sensitive documents. Update to version 8.3.12 or later to fix the issue.

Original advisory text
The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauth...
The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtual paths of uploaded files and bypass access controls to download sensitive documents containing PII.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-377Insecure Temporary File
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published28 Apr 2026
Updated4 Nov 2026
First seen28 Apr 2026
Sources
CVE-2025-67223 · NVD
Track software like this
Free during beta