PT-2020-16033 · Hyland · Onbase

Ken · Published 2020-09-11 · Updated 2022-12-06 · CVE-2020-25247

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hyland OnBase versions prior to 18.0.0.33 and versions 19.x through 19.8.9.1000

Description An issue exists where directory traversal is possible, allowing writing to files. This is demonstrated through the FileName parameter.

Recommendations For versions prior to 18.0.0.33, update to version 18.0.0.33 or later. For versions 19.x through 19.8.9.1000, update to a version later than 19.8.9.1000. As a temporary workaround, consider restricting access to the FileName parameter to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-25247

Affected Products

Onbase

References · 4

• https://osv.dev/vulnerability/CVE-2020-25247 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25247 · Security Note
• http://seclists.org/fulldisclosure/2020/Oct/9 · Note
• https://seclists.org/fulldisclosure/2020/Sep/21 · Note