CVE-2025-67789CWE-284broken-access-control

CVE-2025-67789

Medium · published December 18, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock API.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00222 · 12.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-12-18T02:16Z
Affected products (3)
ProductVersionsFixed in
drivelock/drivelock≥ 24.1, < 24.1.624.1.6
drivelock/drivelock≥ 24.2, < 24.2.724.2.7
drivelock/drivelock≥ 25.1, < 25.1.525.1.5
References (1)
https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-004-DESInfoDisclosure.htm · [email protected]
EPSS history
Timeline
  • 17 DEC 00:00Z
    An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5
    cvelistv5