CVE-2025-35114
BaseFortify
Publication date: 2025-08-26
Last updated on: 2025-09-02
Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| atlassian | agiloft | From 19 (inc) to 30 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1392 | The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Agiloft Release 28, which contains several accounts with default credentials. At least one account's password hash is known and can be cracked offline. This situation could allow an attacker to escalate privileges locally by using these default or cracked credentials.
How can this vulnerability impact me? :
The vulnerability could allow an attacker to gain higher privileges on the affected system by exploiting default credentials and cracking password hashes offline. This local privilege escalation can lead to unauthorized access and control over the system.
What immediate steps should I take to mitigate this vulnerability?
Users should upgrade to Agiloft Release 30 to mitigate this vulnerability.