CVE-2025-34220: Vasion Print (formerly PrinterLogic) Unauthenticated API Leaks Group Information
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains a /api-gateway/identity/search-groups endpoint that does not require authentication. Requests to https://<tenant>.printercloud10.com/api-gateway/identity/search-groups and adjustments to the Host header allow an unauthenticated remote attacker to enumerate every group object stored for that tenant. The response includes internal identifiers (group ID, source service ID, Azure AD object IDs, creation timestamps, and tenant IDs). This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34220?
CVE-2025-34220 is considered a high severity vulnerability due to the lack of authentication for sensitive API endpoints.
How do I fix CVE-2025-34220?
To fix CVE-2025-34220, upgrade Vasion Print to version 25.1.102 or later and Vasion Application to version 25.1.1413 or later.
What are the potential impacts of CVE-2025-34220?
The vulnerability in CVE-2025-34220 could allow unauthorized users to access sensitive information by exploiting the unsecured API endpoint.
Which versions are affected by CVE-2025-34220?
CVE-2025-34220 affects Vasion Print prior to version 25.1.102 and Vasion Application prior to version 25.1.1413.
Is CVE-2025-34220 exploitable in cloud deployments?
Yes, CVE-2025-34220 is exploitable in VA/SaaS deployments of Vasion Print and Application.