CVE-2019-25066 ajenti API privileges management

What is CVE-2019-25066?

CVE-2019-25066 is a medium-severity vulnerability in unspecified ajenti, published on 9 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component.

Weakness: CWE-78, CWE-269

Which versions are affected by CVE-2019-25066?

It affects 1 product.

Products include Ajenti Ajenti.

How do I fix CVE-2019-25066?

No fix has been published for CVE-2019-25066 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-25066 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25066 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in unspecified ajenti

• CVE-2018-1000082 Cross-site request forgery in n/a High 8.8
• CVE-2026-27975 Ajenti has a potential Remote Code Execution High 8.1
• CVE-2018-1000081 Denial of service in n/a High 7.5
• CVE-2018-1000126 Information disclosure in n/a High 7.5
• CVE-2026-35175 Ajenti has an authorization bypass during custom package installation High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p28j-xhp9-88wp.