CVE-2025-43024CWE-497

CVE-2025-43024

High · published October 28, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

⚠️ A sneaky GUI dialog is spilling the beans! It lets users peek into the file system without checking if they should — like a reception desk that gives out employee files without asking for ID. 😲 Imagine walking into a hotel lobby and finding the guest registry open for anyone to browse. This vulnerability is just like that — unauthorized access to potentially sensitive information is wide open, and anyone could take a look without proper clearance. An attacker could easily exploit this weakness to view files they shouldn’t have access to, potentially leading to information leaks or other security breaches. While it may not be a complete disaster, it's still a very concerning issue that could undermine user trust and system integrity.

Put simply

Imagine walking into a hotel lobby and finding the guest registry open for anyone to browse. This vulnerability is just like that — unauthorized access to potentially sensitive information is wide open, and anyone could take a look without proper clearance. This vulnerability allows unauthorized users to view the contents of the file system through an application’s GUI dialog, lacking proper authorization checks to secure file access.

What to do

An attacker could easily exploit this weakness to view files they shouldn’t have access to, potentially leading to information leaks or other security breaches. While it may not be a complete disaster, it's still a very concerning issue that could undermine user trust and system integrity. To remediate this, ensure that appropriate access controls are implemented to restrict file visibility based on user permissions. Review and update the application to patch this vulnerability and conduct security audits to prevent unauthorized access in the future. You’ve got this! By following these steps, you can lock this down and keep your files secure! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00277 · 19.0th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-10-28T04:15Z
Affected products (6)
ProductVersionsFixed in
hp/thinproall versions—
hp/thinproall versions—
hp/thinproall versions—
hp/thinproall versions—
hp/thinproall versions—
hp/thinproall versions—
References (1)
EPSS history
Timeline
  • 27 OCT 23:11Z
    HP ThinPro 8.1 SP8 Security Updates
    cvelistv5