CVE-2025-54768 — KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information

CVE-2025-54768

KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information PUBLISHED

Description (CNA)

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.

Affected (CNA)

Vendor / product	Versions
Xorux / LPAR2RRD	affected 8.04

CWE

CWE-648

References

https://korelogic.com/Resources/Advisories/KL-001-2025-015.txt
https://lpar2rrd.com/note800.php

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/Jul/18