CVE-2012-1617

Published: Sep 26, 2012Modified: Apr 29, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files.

Affected (22)

Products: Juan Ramon: Osclass

1 product

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Juan Ramon Osclass	Up to 2.3.5
Juan Ramon Osclass	Version 1.1
Juan Ramon Osclass	Version 1.1 rc
Juan Ramon Osclass	Version 1.2 alpha
Juan Ramon Osclass	Version 1.2 beta
Juan Ramon Osclass	Version 1.2 delta
Juan Ramon Osclass	Version 2.0.1
Juan Ramon Osclass	Version 2.0.2
Juan Ramon Osclass	Version 2.0.3
Juan Ramon Osclass	Version 2.0
Juan Ramon Osclass	Version 2.0 rc
Juan Ramon Osclass	Version 2.1.1
Juan Ramon Osclass	Version 2.1
Juan Ramon Osclass	Version 2.2.1
Juan Ramon Osclass	Version 2.2.2
Juan Ramon Osclass	Version 2.2.3
Juan Ramon Osclass	Version 2.2
Juan Ramon Osclass	Version 2.3.1
Juan Ramon Osclass	Version 2.3.2
Juan Ramon Osclass	Version 2.3.3
Juan Ramon Osclass	Version 2.3.4
Juan Ramon Osclass	Version 2.3

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (28)

http://archives.neohapsis.com/archives/bugtraq/2012-03/0024.html

Source: secalert@redhat.com

Exploit

http://osclass.org/2012/03/05/osclass-2-3-6/

Source: secalert@redhat.com

ExploitPatch

http://secunia.com/advisories/48284

Source: secalert@redhat.com

Vendor Advisory

http://www.codseq.it/advisories/osclass_directory_traversal_vulnerability

Source: secalert@redhat.com

Exploit

http://www.openwall.com/lists/oss-security/2012/04/02/1

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/04/02/6

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/04/03/1

Source: secalert@redhat.com

Exploit

http://www.openwall.com/lists/oss-security/2012/04/04/7

Source: secalert@redhat.com

ExploitPatch

http://www.securityfocus.com/bid/52336

Source: secalert@redhat.com

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/73754

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/73755

Source: secalert@redhat.com

https://github.com/osclass/OSClass/commit/1e7626f4e1a26371480989c0b937f107ea9a6d4b

Source: secalert@redhat.com

ExploitPatch

https://github.com/osclass/OSClass/commit/a40b76695994442644e46e1b776d79660500566a

Source: secalert@redhat.com

ExploitPatch

https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-1

Source: secalert@redhat.com

ExploitPatch

http://archives.neohapsis.com/archives/bugtraq/2012-03/0024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://osclass.org/2012/03/05/osclass-2-3-6/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://secunia.com/advisories/48284

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.codseq.it/advisories/osclass_directory_traversal_vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.openwall.com/lists/oss-security/2012/04/02/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2012/04/02/6

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2012/04/03/1

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.openwall.com/lists/oss-security/2012/04/04/7

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.securityfocus.com/bid/52336

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/73754

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/73755

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/osclass/OSClass/commit/1e7626f4e1a26371480989c0b937f107ea9a6d4b

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/osclass/OSClass/commit/a40b76695994442644e46e1b776d79660500566a

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-1

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.