PT-2025-12873 · Unknown · Oxari Servicedesk

Published 2025-03-26 · Updated 2025-03-26 · CVE-2025-1542

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OXARI ServiceDesk versions prior to 2.0.324.0

Description The issue is related to improper permission control in the OXARI ServiceDesk application, allowing an attacker with guest access or an unprivileged account to gain additional administrative permissions.

Recommendations For versions prior to 2.0.324.0, update to version 2.0.324.0 or later to resolve the issue. As a temporary workaround, consider restricting access to administrative features until the update is applied.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-425

Related Identifiers

CVE-2025-1542

Affected Products

Oxari Servicedesk

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-1542 · Security Note
• https://cert.pl/en/posts/2025/03/CVE-2025-1542 · Note
• https://twitter.com/CVEnew/status/1904857802201301465 · Twitter Post
• https://twitter.com/CveFindCom/status/1904858975784280351 · Twitter Post
• https://t.me/cvedetector/21175 · Telegram Post
• https://oxari.com/en/product/oxari-servicedesk · Note
• https://t.me/cvetracker/19950 · Telegram Post
• https://twitter.com/SecuriTricks/status/1904888227497918569 · Twitter Post
• https://t.me/latest_high_impact_cve/2051 · Telegram Post
• https://t.me/cvenotify/116291 · Telegram Post