CVE-2025-7371

MEDIUM

6.8

Description

Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions.

CVE Details

CVSS v3.1 Score6.8

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published7/22/2025

Last Modified7/25/2025

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-532

References

https://help.okta.com/oie/en-us/content/topics/settings/version_histories/ver_history_opp_agent.htm(psirt@okta.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.