CVE-2025-3651CWE-346CWE-668

Command Injection in iManage Work Desktop for Mac's Agent Service

Critical · published April 17, 2025

CVSS v4.0
9.3
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier

allows attackers to execute arbitrary commands via unauthorized access to the Agent service.

This has been remediated in Work Desktop for Mac version 10.8.2.33.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00278 · 19.2th percentile
Weaknesses
CWE-346 · Origin Validation Error; CWE-668 · Exposure of Resource to Wrong Sphere
Published
2025-04-17T14:58Z
EPSS history
Timeline
  • 17 APR 14:58Z
    Command Injection in iManage Work Desktop for Mac's Agent Service
    cvelistv5