Description
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Xorux | LPAR2RRD | 8.04 | — |
References
- https://korelogic.com/Resources/Advisories/KL-001-2025-015.txt third-party-advisory
- https://lpar2rrd.com/note800.php release-notes