Read the docs
TI-2025-01476 Aliases CVE-2025-1714GHSA-4mg2-h6wh-4hj2

Username Enumeration in Gliffy

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-307.

Summary

Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid user emails and potentially DOS the server

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed Gliffy (Perforce): 4.14.0-7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PerforceGliffybefore 4.14.0-74.14.0-7Patch availableCNA
  • Gliffy VendorPerforce Affected before 4.14.0-7 Fixed in 4.14.0-7 Patch available CNA

Remediation

  • Fix · CNA Gliffy (Perforce) Fixed in 4.14.0-7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1714
  2. 2026-10-03 Alias added: GHSA-4mg2-h6wh-4hj2

References

Other 1

  • TI-2026-58853 Unauthenticated Remote Code Execution in Akana API Platform CVSS 4.0CRITICAL 10.0
  • TI-2026-71533 Perforce Helix Authentication Service ships a default SCIM token CVSS 4.0CRITICAL 9.3
  • TI-2026-05304 Insecure Default Configuration in P4 Server CVSS 4.0HIGH 8.8
  • TI-2015-07378 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2007-00095 The Perforce client does not restrict the set of files that it overwrites upon receiving… CVSS 2.0HIGH 10.0
  • TI-2026-60410 XML External Entity in Akana API Platform CVSS 4.0CRITICAL 9.2
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences