CVE-2025-3317
Last modified
CVE-2025-3317 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f. Affected is an unknown function of the file opencms-dev/src/main/webapp/view/admin/document/dataPage.jsp. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f. Affected is an unknown function of the file opencms-dev/src/main/webapp/view/admin/document/dataPage.jsp. The manipulation of the argument path leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fumiao | Opencms | All versions |
References
- https://gitee.com/fumiao/opencms/issues/IBLJLMPermissions Required
- https://vuldb.com/?ctiid.303516Permissions Required, VDB Entry
- https://vuldb.com/?id.303516Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-3317?
How severe is CVE-2025-3317?
How do I fix CVE-2025-3317?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-33138IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML…6.1
- CVE-2025-3314A vulnerability has been found in SourceCodester Apartment V…9.8
- CVE-2025-33142IBM WebSphere Application Server 8.5 and 9.0 could provide w…7.5
- CVE-2025-3315A vulnerability was found in SourceCodester Apartment Visito…9.8
- CVE-2025-33150IBM Cognos Analytics Certified Containers 12.1.0 could discl…5.3
- CVE-2025-3316A vulnerability was found in PHPGurukul Men Salon Management…9.8
- CVE-2025-33176NVIDIA RunAI for all platforms contains a vulnerability wher…6.2
- CVE-2025-33177NVIDIA Jetson Linux and IGX OS contain a vulnerability in Nv…5.5
- CVE-2025-33178NVIDIA NeMo Framework for all platforms contains a vulnerabi…7.8
- CVE-2025-33179NVIDIA Cumulus Linux and NVOS products contain a vulnerabili…8.8
- CVE-2025-3318A vulnerability classified as critical was found in Kenj_Fro…6.3
- CVE-2025-33180NVIDIA Cumulus Linux and NVOS products contain a vulnerabili…8.8
Are you affected by CVE-2025-3317?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST