« Volver al listado

CVE-2025-15097

Estado: AplazadaMedia (5.5)—

A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125 and 2025.1.1.1.31 can resolve this issue. Upgrading the affected component is recommended.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Alteryx — Alteryx ServerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-15097",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-15097",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-26T19:30:44.954905Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "vendor": "Alteryx",
          "product": "Server",
          "versions": [
            {
              "status": "affected",
              "version": "2020.2.3.27789"
            },
            {
              "status": "affected",
              "version": "2021.4.2.47895"
            },
            {
              "status": "affected",
              "version": "2022.1.1.30961"
            },
            {
              "status": "affected",
              "version": "2022.1.1.42707"
            },
            {
              "status": "affected",
              "version": "2023.1.1.123"
            },
            {
              "status": "affected",
              "version": "2023.1.1.306"
            },
            {
              "status": "affected",
              "version": "2023.2.1.51"
            },
            {
              "status": "affected",
              "version": "2024.1.1.49"
            },
            {
              "status": "affected",
              "version": "2024.1.1.136"
            },
            {
              "status": "affected",
              "version": "2024.1.1.209"
            },
            {
              "status": "affected",
              "version": "2024.2.1.14"
            },
            {
              "status": "affected",
              "version": "2024.2.1.41"
            },
            {
              "status": "affected",
              "version": "2024.2.1.73"
            },
            {
              "status": "affected",
              "version": "2024.2.1.94"
            },
            {
              "status": "unaffected",
              "version": "2023.1.1.13.486"
            },
            {
              "status": "unaffected",
              "version": "2023.2.1.10.293"
            },
            {
              "status": "unaffected",
              "version": "2024.1.1.9.236"
            },
            {
              "status": "unaffected",
              "version": "2024.2.1.6.125"
            },
            {
              "status": "unaffected",
              "version": "2025.1.1.1.31"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-12-26T03:15:50.273",
  "references": [
    {
      "url": "https://gist.github.com/apostolovd/f84631eed2f0c0e83e2e174b1480f08c",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://help.alteryx.com/release-notes/en/release-notes/server-release-notes/server-2025-1-release-notes.html",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://ict-strypes.eu/wp-content/uploads/2025/12/Alteryx-Second-Research.pdf",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?ctiid.338428",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?id.338428",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/?submit.710169",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125 and 2025.1.1.1.31 can resolve this issue. Upgrading the affected component is recommended."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad fue encontrada en Alteryx Server. Afectada por este problema es alguna funcionalidad desconocida del archivo /gallery/api/status/. Realizar manipulación resulta en autenticación impropia. El ataque es posible de ser llevado a cabo remotamente. El exploit ha sido hecho público y podría ser usado. Actualizar a la versión 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125 y 2025.1.1.1.31 puede resolver este problema. Actualizar el componente afectado es recomendado."
    }
  ],
  "lastModified": "2026-06-17T08:37:06.367",
  "sourceIdentifier": "cna@vuldb.com"
}