CVE-2025-34220
Description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains a /api-gateway/identity/search-groups endpoint that does not require authentication. Requests to https://.printercloud10.com/api-gateway/identity/search-groups and adjustments to the Host header allow an unauthenticated remote attacker to enumerate every group object stored for that tenant. The response includes internal identifiers (group ID, source service ID, Azure AD object IDs, creation timestamps, and tenant IDs). This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6<25.1.102+ 2 more
- (no CPE)range: <25.1.102
- (no CPE)range: *
- cpe:2.3:a:vasion:virtual_appliance_host:*:*:*:*:*:*:*:*range: <25.1.102
- Range: <25.1.1413
- Range: *
- cpe:2.3:a:vasion:virtual_appliance_application:*:*:*:*:*:*:*:*Range: <25.1.1413
Patches
Vulnerability mechanics
References
4- pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.htmlnvdExploitThird Party Advisory
- help.printerlogic.com/saas/Print/Security/Security-Bulletins.htmnvdVendor Advisory
- help.printerlogic.com/va/Print/Security/Security-Bulletins.htmnvdVendor Advisory
- www.vulncheck.com/advisories/vasion-print-printerlogic-unauth-api-leaks-group-infonvdThird Party Advisory
News mentions
0No linked articles in our index yet.