CVE-2025-69907
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-01-26
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| newgen | omnidocs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unauthenticated information disclosure issue in Newgen OmniDocs. It occurs because the /omnidocs/GetListofCabinet API endpoint lacks proper authentication and access control, allowing a remote attacker to access it without valid credentials. As a result, the attacker can retrieve sensitive internal configuration information such as cabinet names and database-related metadata, which could be used to understand backend deployment details and plan further attacks.
How can this vulnerability impact me? :
The vulnerability can impact you by exposing sensitive internal configuration information to unauthorized users. This exposure can lead to unauthorized enumeration of backend deployment details, potentially enabling attackers to craft more targeted and effective attacks against your system, increasing the risk of data breaches or system compromise.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the /omnidocs/GetListofCabinet API endpoint without authentication and checking if sensitive internal configuration information is returned. A simple command using curl to test this would be: curl -v http://<target-host>/omnidocs/GetListofCabinet If the response contains cabinet names or database metadata without requiring credentials, the system is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing proper authentication and access control on the /omnidocs/GetListofCabinet API endpoint to prevent unauthenticated access. Additionally, restrict network access to this endpoint to trusted users only and monitor access logs for unauthorized attempts. [1]