« Volver al listado

CVE-2020-25257

Estado: ModificadaCrítica (9.8)—

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows XXE attacks for read/write access to arbitrary files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hyland — Onbase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-25257",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-11T03:15:12.957",
  "references": [
    {
      "url": "https://seclists.org/fulldisclosure/2020/Sep/23",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://seclists.org/fulldisclosure/2020/Sep/23",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows XXE attacks for read/write access to arbitrary files."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Hyland OnBase versión 16.0.2.83 e inferior, versión 17.0.2.109 e inferior, versión 18.0.0.37 e inferior, versión 19.8.16.1000 e inferior y versión 20.3.10.1000 e inferior. Permite ataques XXE para el acceso de lectura/escritura a archivos arbitrarios"
    }
  ],
  "lastModified": "2026-06-17T03:06:40.690",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8676658E-9F96-4213-9062-119274A085A4",
              "versionEndIncluding": "16.0.2.83"
            },
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46DE98EF-38B4-4C32-8FF1-54D1733771AC",
              "versionEndIncluding": "17.0.2.109",
              "versionStartIncluding": "17.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFEE664C-014B-4B42-8DA2-86617D8E279E",
              "versionEndIncluding": "18.0.0.37",
              "versionStartIncluding": "18.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78E72BFC-F30C-45FF-9253-2CF1FF633B82",
              "versionEndIncluding": "19.8.16.1000",
              "versionStartIncluding": "19.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:hyland:onbase:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "966A05D7-1D0A-4618-9DFC-8F1A062D3DC6",
              "versionEndIncluding": "20.3.10.1000",
              "versionStartIncluding": "20.0.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}