OpenText Flipper CVE-2025-8052

Exploitation requires an authenticated low-privilege account (PR:L) with the ability to send input to the application's HQL (Hibernate Query Language) processor in OpenText Flipper 3.1.2. Per the CVSS 4.0 vector, it is further limited by adjacent-network access only (AV:A - not routable from the internet), a present attack requirement (AT:P - a specific deployment/precondition must hold), and active user interaction (UI:A - a legitimate user action must be involved). The realistic impact is confined to limited unauthorized data extraction (VC/VI/VA each Low) with no effect on other systems (SC:N/SI:N/SA:N). These combined prerequisites - valid credentials, adjacency, and interaction - substantially narrow real-world exploitability beyond the raw SQL-injection class.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector scores only 1.0, driven by a combination of limiting factors: adjacent network access (AV:A, not internet-facing), a present attack requirement (AT:P), a low-privilege-but-still-authenticated attacker (PR:L), active user interaction required (UI:A), and only Low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change to subsequent systems (SC:N/SI:N/SA:N). The EPSS score of 0.36% (27th percentile) corroborates the low urgency, indicating very low near-term exploitation probability. There is no CISA KEV listing and no public exploit identified, so this is not under active exploitation. Nominally a SQL/HQL injection (CWE-564) would raise a flag, but here the realistic impact is constrained to a low-privilege user coaxing the HQL processor into returning limited unintended data - not a pre-auth database takeover. Net: a real but low-severity, low-prevalence finding that should be patched in normal maintenance cycles, not treated as an emergency. The one thing to verify independently is the vendor's AT:P/UI:A characterization, since the terse NVD-linked advisory does not spell out what the attack requirement and user interaction actually are.

An authenticated low-privilege user on an adjacent network segment submits crafted input that reaches the HQL (Hibernate Query Language) processor in OpenText Flipper 3.1.2, manipulating the generated query to read database rows the user is not authorized to see. Exploitation depends on an additional attack requirement and active user interaction per the CVSS 4.0 vector, limiting it to specific conditions rather than a simple drive-by. No public proof-of-concept exploit code was identified at the time of analysis.