Paper/Archive/CVE-2025-59683

CVE-2025-59683

Pexip Infinity — Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Off…

EPSS 0.3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 26.3.263 × 205.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.

Affected

ProductAffectedFixed inSource

Infinity15.0 – < 38.138.1CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

mitre (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refdocs.pexip.com/admin/security_bulletins.htm