CVE-2015-3897

EPSS 17.7%◆ VulnCheck KEV

Vexday Risk Score

65High priority

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 17.7%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

10 Jun 2015Public PoC

18 Jun 2015Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.htmlunverified exploitdbwww.exploit-db.com/exploits/37260unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html https://www.htbridge.com/advisory/HTB23259 http://www.securityfocus.com/archive/1/535733/100/0/threaded