One Identity Password Manager up to 5.14.3 window.print inclusion of functionality from untrusted control sphere

Summaryinfo

A vulnerability classified as critical has been found in One Identity Password Manager up to 5.14.3. Impacted is the function window.print. The manipulation leads to inclusion of functionality from untrusted control sphere. This vulnerability is listed as CVE-2025-27582. It is possible to launch the attack on the physical device. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in One Identity Password Manager up to 5.14.3. This issue affects the function window.print. The manipulation with an unknown input leads to a inclusion of functionality from untrusted control sphere vulnerability. Using CWE to declare the problem leads to CWE-829. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Specifically, the application attempts to restrict privileged actions by overriding the native window.print() function. However, this protection can be bypassed by an attacker who accesses the Password Self-Service site from the lock screen and navigates to an attacker-controlled webpage via the Help function. By hosting a crafted web page with JavaScript, the attacker can restore and invoke the window.print() function, launching a SYSTEM-privileged print dialog. From this dialog, the attacker can exploit standard Windows functionality - such as the Print to PDF or Add Printer wizard - to spawn a command prompt with SYSTEM privileges. Successful exploitation allows a local attacker (with access to a locked workstation) to gain SYSTEM-level privileges, granting full control over the affected device.

It is possible to read the advisory at cyberis.com. The identification of this vulnerability is CVE-2025-27582 since 03/03/2025. The exploitation is known to be easy. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 5.14.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21342). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• One Identity

Name

• Password Manager

Version

• 5.14.0
• 5.14.1
• 5.14.2
• 5.14.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion