CVE-2025-69908
Information Disclosure in Newgen OmniApp via Public JavaScript Resource
Publication date: 2026-01-23
Last updated on: 2026-02-11
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| newgensoft | omniapp | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unauthenticated information disclosure issue in Newgen OmniApp that allows attackers to enumerate valid privileged usernames by accessing a publicly available client-side JavaScript resource. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by exposing valid privileged usernames to attackers without authentication, which could facilitate further targeted attacks such as privilege escalation or unauthorized access attempts. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting the publicly accessible client-side JavaScript resources of the Newgen OmniApp installation to see if they expose valid privileged usernames. Network monitoring tools or web application scanners can be used to identify requests to such JavaScript files. Specific commands might include using curl or wget to fetch the JavaScript resource and grep or similar tools to search for username enumeration patterns. For example: curl -s http://target/newgen/path/to/client.js | grep -i username [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the client-side JavaScript resources that expose privileged usernames, implementing proper access controls, and applying any available patches or updates from Newgen OmniApp. Additionally, monitoring and alerting on unusual access patterns to these resources can help reduce risk. [1]