CVE-2012-2315

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

6.22%

Published

Sep 9, 2012

Modified

Apr 28, 2026

Public PoC / Exploit (1)

All weaponized →

Exploit-DBOpenKM Document Management System 5.1.7 - Command Execution

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action.

Weaknesses (CWE)

CWE-264

Affected Products (2)

openkm · openkmvulnerable

References (20)

http://archives.neohapsis.com/archives/bugtraq/2012-01/0007.html

http://archives.neohapsis.com/archives/bugtraq/2012-01/0021.html

http://osvdb.org/78105

http://secunia.com/advisories/47424

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/03/23/6

http://www.openwall.com/lists/oss-security/2012/03/23/8

http://www.openwall.com/lists/oss-security/2012/04/27/6

http://www.openwall.com/lists/oss-security/2012/05/04/13

http://www.openwall.com/lists/oss-security/2012/05/04/2

http://www.securityfocus.com/bid/51250

https://exchange.xforce.ibmcloud.com/vulnerabilities/72112