« Volver al listado

CVE-2017-12586

Estado: ModificadaMedia (6.5)—

SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Slims — Akasia

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-12586",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-08-06T03:29:00.337",
  "references": [
    {
      "url": "https://github.com/slims/slims8_akasia/issues/48",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/slims/slims8_akasia/issues/48",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users."
    },
    {
      "lang": "es",
      "value": "La versión 8.3.1 de SLiMS 8 Akasia tiene un problema de lectura de archivos arbitrarios debido a un salto de directorio en el parámetro url al admin/help.php. Esta vulnerabilidad puede ser explotada por usuarios remotos de librería remotos autenticados."
    }
  ],
  "lastModified": "2026-06-17T01:03:33.257",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E9D9E614-A634-4769-B76D-0D1E1E693275"
            },
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "382402AC-A381-447A-9C5A-5280D4632835"
            },
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDD6A532-C370-49C6-95C8-5543F50A5963"
            },
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98C6AF7D-5966-40BC-855E-ED15EA126622"
            },
            {
              "criteria": "cpe:2.3:a:slims:akasia:8.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F979A52-EBEF-470C-B226-ADC5A3B65EC2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}