CVE-2012-2315

🗓️ 09 Sep 2012 21:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Admin/Auth in OpenKM 5.1.7 & prior versions allows remote authenticated users to assign administrator privileges to arbitrary users via userEdit action

Reporter	Title	Published	Views	Family All 5
Circl	CVE-2012-2315	3 Jan 201200:00	–	circl
Cvelist	CVE-2012-2315	9 Sep 201221:00	–	cvelist
Exploit DB	OpenKM Document Management System 5.1.7 - Command Execution	3 Jan 201200:00	–	exploitdb
NVD	CVE-2012-2315	9 Sep 201221:55	–	nvd
Prion	Deserialization of untrusted data	9 Sep 201221:55	–	prion

NVD

Node

openkm openkmRange≤5.1.7

openkm openkmMatch5.1.8

Source	Link
openwall	www.openwall.com/lists/oss-security/2012/05/04/13
archives	www.archives.neohapsis.com/archives/bugtraq/2012-01/0021.html
securityfocus	www.securityfocus.com/bid/51250
secunia	www.secunia.com/advisories/47424
openwall	www.openwall.com/lists/oss-security/2012/03/23/6
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/72112
osvdb	www.osvdb.org/78105
archives	www.archives.neohapsis.com/archives/bugtraq/2012-01/0007.html
openwall	www.openwall.com/lists/oss-security/2012/05/04/2
openwall	www.openwall.com/lists/oss-security/2012/03/23/8

Parameter	Position	Path	Description	CWE
script	query param	/OpenKM/admin/scripting.jsp	CSRF-prone admin script execution endpoint allows remote authenticated users to run OS commands in admin session via the scripting.jsp endpoint.	CWE-264

16 Jun 2026 23:41Current

6.6Medium risk

Vulners AI Score6.6

CVSS 24

EPSS0.06218

CWE-264