{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T08:57:31.661","vulnerabilities":[{"cve":{"id":"CVE-2025-7204","sourceIdentifier":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","published":"2025-07-09T15:15:25.283","lastModified":"2026-06-17T10:04:30.740","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In ConnectWise PSA versions older than 2025.9, a\nvulnerability exists where authenticated users could gain access to sensitive\nuser information. Specific API requests were found to return an overly verbose\nuser object, which included encrypted password hashes for other users.\nAuthenticated users could then retrieve these hashes. \n\n\n\nAn\nattacker or privileged user could then use these exposed hashes to conduct\noffline brute-force or dictionary attacks. Such attacks could lead to\ncredential compromise, allowing unauthorized access to accounts, and\npotentially privilege escalation within the system."},{"lang":"es","value":"En versiones de ConnectWise PSA anteriores a la 2025.9, existe una vulnerabilidad que permite a los usuarios autenticados acceder a información confidencial. Se detectó que ciertas solicitudes de API devolvían un objeto de usuario excesivamente detallado, que incluía hashes de contraseñas cifradas de otros usuarios. Los usuarios autenticados podían recuperar estos hashes. Un atacante o un usuario con privilegios podría utilizar estos hashes expuestos para realizar ataques de fuerza bruta o de diccionario sin conexión. Estos ataques podrían comprometer las credenciales, lo que permitiría el acceso no autorizado a las cuentas y, potencialmente, la escalada de privilegios dentro del sistema."}],"affected":[{"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","affectedData":[{"vendor":"ConnectWise","product":"PSA","defaultStatus":"unaffected","versions":[{"version":"All versions prior to 2025.9","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-09T15:57:27.486627Z","id":"CVE-2025-7204","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:connectwise:professional_service_automation:*:*:*:*:*:*:*:*","versionEndExcluding":"2025.9","matchCriteriaId":"DD2F9F81-71CE-4BDC-8AD5-F79AB890D229"}]}]}],"references":[{"url":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-psa-2025.9-security-fix","source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","tags":["Vendor Advisory"]},{"url":"https://www.themissinglink.com.au/security-advisories/cve-2025-7204","source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","tags":["Third Party Advisory"]}]}}]}