CVE-2025-54834: OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54834?
CVE-2025-54834 has been classified as a high severity vulnerability due to the potential for an unauthorized attacker to enumerate valid usernames.
How do I fix CVE-2025-54834?
To remediate CVE-2025-54834, implement rate limiting on the /App/CreateRequest.aspx endpoint and ensure that proper authentication mechanisms are in place.
Which software versions are affected by CVE-2025-54834?
CVE-2025-54834 affects OPEXUS FOIAXpress Public Access Link version v11.1.0.
What type of attack does CVE-2025-54834 enable?
CVE-2025-54834 enables unauthenticated remote attackers to query the application to check for valid usernames.
Is user authentication required to exploit CVE-2025-54834?
No, user authentication is not required to exploit CVE-2025-54834, making it particularly dangerous.