A critical vulnerability in Aranda Service Desk allows unauthenticated remote attackers to access sensitive documents and PII by exploiting predictable log file naming conventions.

This is an information disclosure vulnerability where the Aranda File Server component uses predictable file names for activity logs. This flaw allows any unauthenticated remote attacker to retrieve these logs and identify the virtual paths of sensitive uploaded files, effectively bypassing existing access controls.

The exposure of sensitive documents containing Personally Identifiable Information (PII) presents a significant risk to data privacy and regulatory compliance. With a CVSS score of 7.5, this high severity vulnerability enables unauthorized access to internal resources without requiring authentication, potentially leading to widespread data breaches and reputational damage.

Immediate Action: Update Aranda Service Desk to version 8.3.12 or later to apply the vendor fix addressing log file predictability.

Proactive Monitoring: Review web server access logs for anomalous requests targeting log file directories or patterns indicating directory traversal and unauthorized file retrieval attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to the file server directory and block requests containing patterns identified in the published proof-of-concept.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub, as identified in the enrichment references.

Given that this vulnerability is both unauthenticated and automatable, it poses an immediate risk to any exposed Aranda Service Desk instance. Security teams must prioritize updating to version 8.3.12 or higher to ensure the security of stored documents. If patching is not immediately feasible, restrict network access to the affected file server component until the fix can be applied.