CVE-2025-2236

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation. The vulnerability could reveal sensitive information while managing and configuring of the external services.

This issue affects Advanced Authentication versions before 6.5.

Metrics

CVSS 4.0 2.1/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:C/RE:M/U:Red

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
OpenText	Advanced Authentication	< 6.5

References

https://portal.microfocus.com/s/article/KM000039947

Timeline

Published: May 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-223607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promact WP Azure offload wp-azure-offl CVE-2025-223617.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics open CVE-2025-223626.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Bakovic WPAchievements Free wpa CVE-2025-223635.3Missing Authorization vulnerability in Hermann LAHAMI Allada T-shirt Designer for Woocommerce allada-tshirt-designer-for-woocommerce.This is CVE-2025-223647.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Service Shogun Ach CVE-2025-223656.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric McNiece EMC2 Alert Boxes allows S CVE-2025-223668.7The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution CVE-2025-223678.7The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution be CVE-2025-223688.7The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution becau CVE-2025-223697.1The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying CVE-2025-22379.8The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including,CVE-2025-223705.3Many fields for the web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to execute arbitra