« Volver al listado

CVE-2020-25248

Estado: ModificadaAlta (7.5)—

An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Directory traversal exists for reading files, as demonstrated by the FileName parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hyland — Onbase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-25248",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-11T03:15:12.287",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2020/Oct/9",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://seclists.org/fulldisclosure/2020/Oct/9",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://seclists.org/fulldisclosure/2020/Sep/21",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2020/Oct/9",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://seclists.org/fulldisclosure/2020/Oct/9",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://seclists.org/fulldisclosure/2020/Sep/21",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Directory traversal exists for reading files, as demonstrated by the FileName parameter."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Hyland OnBase hasta la versión 16.0.2.83 e inferior, versión 17.0.2.109 e inferior, versión 18.0.0.37 e inferior, versión 19.8.16.1000 e inferior y versión 20.3.10.1000 e inferior. Existe un recorrido de directorios para la lectura de archivos, como lo demuestra el parámetro FileName"
    }
  ],
  "lastModified": "2026-06-17T03:06:39.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8676658E-9F96-4213-9062-119274A085A4",
              "versionEndIncluding": "16.0.2.83"
            },
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46DE98EF-38B4-4C32-8FF1-54D1733771AC",
              "versionEndIncluding": "17.0.2.109",
              "versionStartIncluding": "17.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFEE664C-014B-4B42-8DA2-86617D8E279E",
              "versionEndIncluding": "18.0.0.37",
              "versionStartIncluding": "18.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78E72BFC-F30C-45FF-9253-2CF1FF633B82",
              "versionEndIncluding": "19.8.16.1000",
              "versionStartIncluding": "19.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "966A05D7-1D0A-4618-9DFC-8F1A062D3DC6",
              "versionEndIncluding": "20.3.10.1000",
              "versionStartIncluding": "20.0.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}