PT-2025-6832 · Q Free · Q-Free Maxtime

Andrea Palanca + 1 · Published 2025-02-12 · Updated 2025-11-19 · CVE-2025-1101

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Q-Free MaxTime versions less than or equal to 2.11.0

Description A "Observable Response Discrepancy" in the login page allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests. This issue is related to the login functionality, where differences in response can reveal whether a username is valid or not.

Recommendations For Q-Free MaxTime versions less than or equal to 2.11.0, update to a version greater than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-1101

Affected Products

Q-Free Maxtime

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-1101 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1101 · Vendor Advisory
• https://twitter.com/CVEnew/status/1889673470939746603 · Twitter Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-1101 · Note
• https://twitter.com/dailycve/status/1991256853313900724 · Twitter Post