Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-43926
CVE-2025-43926:
Linux Debian vulnerability analysis and mitigation
Overview
A vulnerability was discovered in Znuny versions through 6.5.14 and 7.x through 7.1.6, disclosed on May 8, 2025. The vulnerability affects the AgentPreferences UpdateAJAX subaction functionality, allowing custom AJAX calls to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings (NVD, Znuny Advisory).
Technical details
The vulnerability is classified as CWE-79 (Cross-site Scripting) with a CVSS v3.1 base score of 6.1 (MEDIUM). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is changed (S:C) with low confidentiality and integrity impact (C:L, I:L) and no availability impact (A:N) (NVD, Wiz).
Impact
When exploited, the vulnerability allows an agent with a valid session to elevate their permissions through XSS by modifying their own preferences. The GetUserData functionality retrieves these manipulated keys and values, which can then be used to affect permissions or other settings (Znuny Advisory, Wiz).
Mitigation and workarounds
Debian 13 has released a fix for the vulnerability, while Debian 12 remains without a fix as of May 06, 2025. Ubuntu distributions are currently under evaluation for versions 25.04, 24.10, and 24.04 LTS (Ubuntu, Debian Tracker).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management