Early Access — Mondoo Vulnerability Intelligence is currently in preview.

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

Vulnerability Intelligence

CVE-2025-3651 | Mondoo Vulnerability Intelligence

CVE-2025-3651

CRITICAL9.3

Command Injection in iManage Work Desktop for Mac's Agent Service

Published Apr 17, 2025

Modified 9 months ago

No fix available

Details

Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier

allows attackers to execute arbitrary commands via unauthorized access to the Agent service.

This has been remediated in Work Desktop for Mac version 10.8.2.33.

References

WEBhttps://docs.imanage.com/security/CVE-2025-3651.html ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-3651

CVSS Analysis

CVSS v4.0

9.3

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

PassiveUI:P

Vulnerable System

Vuln. Confidentiality

HighVC:H

Vuln. Integrity

HighVI:H

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

HighSC:H

Subseq. Integrity

HighSI:H

Subseq. Availability

NoneSA:N

9.3/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Weakness Type (CWE)

Other

CWE-346

CWE-668

Ecosystems

Timeline

PublishedApr 17, 2025

ModifiedApr 17, 2025