Vulnerability Description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains a /api-gateway/identity/search-groups endpoint that does not require authentication. Requests to https://<tenant>.printercloud10.com/api-gateway/identity/search-groups and adjustments to the `Host` header allow an unauthenticated remote attacker to enumerate every group object stored for that tenant. The response includes internal identifiers (group ID, source service ID, Azure AD object IDs, creation timestamps, and tenant IDs). This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vasion | Virtual Appliance Application | < 25.1.1413 |
| Vasion | Virtual Appliance Host | < 25.1.102 |
Related Weaknesses (CWE)
References
- https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htmVendor Advisory
- https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htmVendor Advisory
- https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilitiExploitThird Party Advisory
- https://www.vulncheck.com/advisories/vasion-print-printerlogic-unauth-api-leaks-Third Party Advisory
- https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilitiExploitThird Party Advisory
FAQ
What is CVE-2025-34220?
CVE-2025-34220 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains a /api-gateway/identity/search-groups en...
How severe is CVE-2025-34220?
CVE-2025-34220 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-34220?
Check the references section above for vendor advisories and patch information. Affected products include: Vasion Virtual Appliance Application, Vasion Virtual Appliance Host.