PT-2025-32284 · Unknown · Openorange Business Framework

Published 2025-08-07 · Updated 2025-08-29 · CVE-2024-42048

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenOrange Business Framework version 1.15.5

Description OpenOrange Business Framework versions 1.15.5 allows unprivileged users to write to the installation directory.

Recommendations Restrict write access to the installation directory for unprivileged users.

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-42048

Affected Products

Openorange Business Framework

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-42048 · Security Note
• https://landings.openorange.com/l/erp-peru-a.html · Note
• https://attack.mitre.org/techniques/T1574/001 · Note
• https://twitter.com/VulmonFeeds/status/1953552184915673225 · Twitter Post
• https://twitter.com/CVEnew/status/1953506243592564981 · Twitter Post
• https://t.me/cveNotify/133969 · Telegram Post
• https://raw.githubusercontent.com/securityadvisories/Security-Advisories/refs/heads/main/Advisories/Blaze%20Information%20Security%20-%20DLL%20Hijacking%20in%20OpenOrange%20Business%20Framework%20Allows%20Arbitrary%20Code%20Execution%20and%20Potential%20Privilege%20Escalation.txt · Note
• https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexa · Note
• https://support.microsoft.com/en-us/topic/secure-loading-of-libraries-to-prevent-dll-preloading-attacks-d41303ec-0748-9211-f317-2edc819682e1 · Note
• https://resources.infosecinstitute.com/topic/dll-hijacking · Note
• https://openorange.com · Note
• https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order · Note
• https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya · Note