critical9.8
CVE-2025-22956
OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients.
Impact
OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead to privilege escalation if any ProductPropertyState contains a secret only intended to be accessible by a subset of clients. One example of this is a domain join account password for the windomain package.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| OPSI | OPSI | before 4.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.