Description
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Xorux | XorMon-NG | 1.8 – < 1.9.38 | 1.9.38 |
References
- https://korelogic.com/Resources/Advisories/KL-001-2025-012.txt third-party-advisory
- https://xormon.com/note190.php release-notes