Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-26844
CVE-2025-26844:
Linux Debian vulnerability analysis and mitigation
Overview
A security vulnerability identified as CVE-2025-26844 affects Znuny, an OTRS Community Edition Fork. The vulnerability relates to incorrect HTTP Cookie settings and was discovered during a customer pentest. The issue affects all versions of Znuny LTS from 6.5.1 up to and including 6.5.11, all versions of Znuny from 7.0.1 up to including 7.1.3, and all versions of Znuny LTS 6.0. The vulnerability was disclosed on February 12, 2025 (Znuny Advisory).
Technical details
The vulnerability involves the HttpOnly cookie attribute not being set correctly in certain situations within the Znuny application. The severity of this vulnerability has been assessed as low according to the vendor's security advisory (Znuny Advisory).
Impact
The improper configuration of the HttpOnly cookie attribute could potentially expose cookie data to unauthorized access, which might lead to session-related security issues (Debian Tracker).
Mitigation and workarounds
The issue has been addressed in newer versions of the software. Users running affected versions should upgrade to the fixed versions. The vulnerability has been fixed in version 6.5.14-1 for Debian trixie/non-free and sid/non-free distributions (Debian Tracker).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management