PT-2025-30343 · Manager Io · Imanager

Kr1Shna4Garwal · Published 2025-07-21 · Updated 2025-07-23 · CVE-2025-54122

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Manager-io/Manager versions up to and including 25.7.18.2519

Description Manager-io/Manager is accounting software with a critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability identified in the proxy handler component. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal services, cloud metadata endpoints, and the exfiltration of sensitive data from isolated network segments.

Recommendations Update to version 25.7.21.2525 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-54122

GHSA-347W-CGWH-M895

Affected Products

Imanager

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54122.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54122 · Security Note
• https://github.com/Manager-io/Manager/security/advisories/GHSA-347w-cgwh-m895 · Note
• https://t.me/cvetracker/28332 · Telegram Post
• https://twitter.com/CVEnew/status/1947405331354816665 · Twitter Post
• https://t.me/pentestingnews/64973 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947481687383761268 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1947836572889710726 · Twitter Post