CVE-2025-5545

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5545
A vulnerability classified as problematic has been found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. This affects the function image of the file src/main/java/cn/gson/oasys/controller/process/ProcedureController.java. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead02.md Exploit
https://vuldb.com/?ctiid.310995 Permissions Required VDB Entry
https://vuldb.com/?id.310995 Third Party Advisory VDB Entry
https://vuldb.com/?submit.585885 Third Party Advisory VDB Entry
https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead02.md Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:aaluoxiang:oa_system:-:*:*:*:*:*:*:*
History

09 Jun 2025, 15:04

Type Values Removed Values Added
First Time Aaluoxiang
Aaluoxiang oa System
CPE cpe:2.3:a:aaluoxiang:oa_system:-:*:*:*:*:*:*:*
References () https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead02.md - () https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead02.md - Exploit
References () https://vuldb.com/?ctiid.310995 - () https://vuldb.com/?ctiid.310995 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.310995 - () https://vuldb.com/?id.310995 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.585885 - () https://vuldb.com/?submit.585885 - Third Party Advisory, VDB Entry

04 Jun 2025, 14:15

Type Values Removed Values Added
References () https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead02.md - () https://github.com/honorseclab/vulns/blob/main/aaluoxiang_oasystem/ArbitaryFileRead02.md -
Summary
  • (es) Se ha detectado una vulnerabilidad clasificada como problemática en aaluoxiang oa_system hasta 5b445a6227b51cee287bd0c7c33ed94b801a82a5. Esta vulnerabilidad afecta la imagen funcional del archivo src/main/java/cn/gson/oasys/controller/process/ProcedureController.java. La manipulación provoca un path traversal. Es posible iniciar el ataque de forma remota. Se ha hecho público el exploit y puede que sea utilizado. Este producto no utiliza control de versiones. Por ello, no se dispone de información sobre las versiones afectadas y no afectadas.

04 Jun 2025, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-04 00:15

Updated : 2025-06-09 15:04

NVD link : CVE-2025-5545

Mitre link : CVE-2025-5545

CVE.ORG link : CVE-2025-5545

JSON object : View

Products Affected

aaluoxiang

  • oa_system
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')