Tanium Discover up to 4.10.89 sql injection

Summaryinfo

A vulnerability was found in Tanium Discover up to 4.10.89. It has been declared as critical. The impacted element is an unknown function. Executing a manipulation can lead to sql injection. This vulnerability is registered as CVE-2025-15325. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Tanium Discover up to 4.10.89 and classified as critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Tanium addressed an improper input validation vulnerability in Discover.

The advisory is shared for download at security.tanium.com. This vulnerability was named CVE-2025-15325 since 12/30/2025. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 4.10.90 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-206832). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Tanium

Name

• Discover

Version

• 4.10.0
• 4.10.1
• 4.10.2
• 4.10.3
• 4.10.4
• 4.10.5
• 4.10.6
• 4.10.7
• 4.10.8
• 4.10.9
• 4.10.10
• 4.10.11
• 4.10.12
• 4.10.13
• 4.10.14
• 4.10.15
• 4.10.16
• 4.10.17
• 4.10.18
• 4.10.19
• 4.10.20
• 4.10.21
• 4.10.22
• 4.10.23
• 4.10.24
• 4.10.25
• 4.10.26
• 4.10.27
• 4.10.28
• 4.10.29
• 4.10.30
• 4.10.31
• 4.10.32
• 4.10.33
• 4.10.34
• 4.10.35
• 4.10.36
• 4.10.37
• 4.10.38
• 4.10.39
• 4.10.40
• 4.10.41
• 4.10.42
• 4.10.43
• 4.10.44
• 4.10.45
• 4.10.46
• 4.10.47
• 4.10.48
• 4.10.49
• 4.10.50
• 4.10.51
• 4.10.52
• 4.10.53
• 4.10.54
• 4.10.55
• 4.10.56
• 4.10.57
• 4.10.58
• 4.10.59
• 4.10.60
• 4.10.61
• 4.10.62
• 4.10.63
• 4.10.64
• 4.10.65
• 4.10.66
• 4.10.67
• 4.10.68
• 4.10.69
• 4.10.70
• 4.10.71
• 4.10.72
• 4.10.73
• 4.10.74
• 4.10.75
• 4.10.76
• 4.10.77
• 4.10.78
• 4.10.79
• 4.10.80
• 4.10.81
• 4.10.82
• 4.10.83
• 4.10.84
• 4.10.85
• 4.10.86
• 4.10.87
• 4.10.88
• 4.10.89

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion