CVE-2025-15097

Alteryx Server status improper authentication

CVSS 6.9 MEDIUMEPSS 0.5%CWE-287

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.9EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

26 dic 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125 and 2025.1.1.1.31 can resolve this issue. Upgrading the affected component is recommended.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

Alteryx · Server

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://gist.github.com/apostolovd/f84631eed2f0c0e83e2e174b1480f08c https://help.alteryx.com/release-notes/en/release-notes/server-release-notes/server-2025-1-release-notes.html https://ict-strypes.eu/wp-content/uploads/2025/12/Alteryx-Second-Research.pdf https://vuldb.com/?ctiid.338428 https://vuldb.com/?id.338428 https://vuldb.com/?submit.710169