ByteOS Network

CVE Vulnerability Details :

CVE-2025-15097

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-26 Dec, 2025 | 02:32

Updated At-26 Dec, 2025 | 19:30

▼CVE Numbering Authority (CNA)

Alteryx Server status improper authentication

A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125 and 2025.1.1.1.31 can resolve this issue. Upgrading the affected component is recommended.

Affected Products

Vendor

Alteryx

Product

Server

Versions

Affected

2020.2.3.27789
2021.4.2.47895
2022.1.1.30961
2022.1.1.42707
2023.1.1.123
2023.1.1.306
2023.2.1.51
2024.1.1.49
2024.1.1.136
2024.1.1.209
2024.2.1.14
2024.2.1.41
2024.2.1.73
2024.2.1.94

Unaffected

2023.1.1.13.486
2023.2.1.10.293
2024.1.1.9.236
2024.2.1.6.125
2025.1.1.1.31

Problem Types

Type	CWE ID	Description
CWE	CWE-287	Improper Authentication

Type: CWE

CWE ID: CWE-287

Description: Improper Authentication

Metrics

Version	Base score	Base severity	Vector
4.0	6.9	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
3.1	7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
3.0	7.3	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2.0	7.5	N/A	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Version: 4.0

Base score: 6.9

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 7.3

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Version: 3.0

Base score: 7.3

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Version: 2.0

Base score: 7.5

Base severity: N/A

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Credits

finder

Diyan Apostolov (ICT Strypes)

reporter

fosi (VulDB User)

Timeline

Event	Date
Advisory disclosed	2025-12-25 00:00:00
VulDB entry created	2025-12-25 01:00:00
VulDB entry last update	2025-12-25 16:23:29

Event: Advisory disclosed

Date: 2025-12-25 00:00:00

Event: VulDB entry created

Date: 2025-12-25 01:00:00

Event: VulDB entry last update

Date: 2025-12-25 16:23:29

References

Hyperlink	Resource
https://vuldb.com/?id.338428	vdb-entry
https://vuldb.com/?ctiid.338428	signature permissions-required
https://vuldb.com/?submit.710169	third-party-advisory
https://ict-strypes.eu/wp-content/uploads/2025/12/Alteryx-Second-Research.pdf	related
https://gist.github.com/apostolovd/f84631eed2f0c0e83e2e174b1480f08c	exploit
https://help.alteryx.com/release-notes/en/release-notes/server-release-notes/server-2025-1-release-notes.html	patch

Hyperlink: https://vuldb.com/?id.338428

Resource:

vdb-entry

Hyperlink: https://vuldb.com/?ctiid.338428

Resource:

signature

permissions-required

Hyperlink: https://vuldb.com/?submit.710169

Resource:

third-party-advisory

Hyperlink: https://ict-strypes.eu/wp-content/uploads/2025/12/Alteryx-Second-Research.pdf

Resource:

Hyperlink: https://gist.github.com/apostolovd/f84631eed2f0c0e83e2e174b1480f08c

Resource:

exploit

Hyperlink: https://help.alteryx.com/release-notes/en/release-notes/server-release-notes/server-2025-1-release-notes.html

Resource:

patch

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Unaffected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References