Comply
CVE-2025-15340
MEDIUM
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Tanium addressed an incorrect default permissions vulnerability in Comply.
AnalysisAI
Tanium addressed an incorrect default permissions vulnerability in Comply. [CVSS 6.5 MEDIUM]
Technical ContextAI
Classified as CWE-276 (Incorrect Default Permissions). Affects Comply. Tanium addressed an incorrect default permissions vulnerability in Comply.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's int
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write a
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user inter
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations w
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticate
Improper access controls (CWE-862 Missing Authorization) in Tanium Comply expose compliance and vulnerability assessment
Improper access controls in Tanium Comply allow an authenticated low-privileged network user to perform write operations
Improper access controls in Tanium Comply allow authenticated low-privileged users to bypass object-level authorization
Improper access controls in Tanium Comply (CWE-862, Missing Authorization) allow authenticated low-privileged users to p
Improper access controls in Tanium Comply allow authenticated low-privileged users to perform unauthorized actions affec
Tanium Comply contains an improper access control vulnerability (CWE-639, Authorization Bypass Through User-Controlled K
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today