Privilege Escalation Risk in OPSI ProductPropertyState Retrieval by OPSI Vendor

CVE-2025-22956

What is CVE-2025-22956?

The OPSI software prior to version 4.3 contains a vulnerability that permits any client to access the ProductPropertyState, which includes sensitive information meant solely for specific clients. This flaw can lead to privilege escalation, as it may expose confidential data, such as passwords for domain join accounts in the windomain package. Such unauthorized access can compromise client security and confidentiality, highlighting the importance of upgrading to a patched version.

References