Eba Plus Document And Workflow Management System
Monthly
Authenticated abuse of the document upload function in eBA Plus Document and Workflow Management System (versions 6.7.141 through 10.0.10) lets a low-privilege user place a Web Shell on the server and, if the uploaded file can be reached through a web-accessible path, run code with the privileges of the web application. The defect is CWE-434 (unrestricted upload of a file with a dangerous type) and carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so valid credentials or a self-registration path are required rather than unauthenticated access, and installations already on 10.0.11 or later are outside the affected range. No public exploit has been identified at time of analysis; TR-CERT (Turkish national CERT) is the reporting and reference source. This is a genuine high-priority issue for organizations running the affected product.
Authenticated path traversal in Bimser eBA Plus Document and Workflow Management System (versions 6.7.141 up to but not including 10.0.11) allows a remote attacker holding a valid low-privilege account to read files outside the intended restricted directory, resulting in high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The vulnerability is a CWE-22 improper limitation of a pathname to a restricted directory, reported by TR-CERT, and exploitation requires an authenticated session - anonymous access is not indicated by the assessed vector. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, so this is a moderate-severity, credentialed information-disclosure issue rather than a top-priority emergency; because the vector is PR:L, only confirmed as an authenticated attack path. Deployments on 10.0.11 or later are not affected.
Stored cross-site scripting (XSS) in eBA Plus Document and Workflow Management System (versions 6.7.141 up to but not including 10.0.11) allows an authenticated low-privilege user to persist script payloads into document, form, or workflow content that other users later render in their browser, where the script executes in the victim's session context. The assessed vector confirms the practical constraints: a valid account is required (PR:L) and a separate user must open the tainted record for the payload to fire (UI:R), with the impact crossing a trust boundary (S:C) so the script can act as the viewing user - this is therefore not exploitable against unauthenticated or default anonymously accessible deployments. Reported through TR-CERT (TR-26-1197), the issue carries a moderate CVSS base score of 5.4, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated abuse of the document upload function in eBA Plus Document and Workflow Management System (versions 6.7.141 through 10.0.10) lets a low-privilege user place a Web Shell on the server and, if the uploaded file can be reached through a web-accessible path, run code with the privileges of the web application. The defect is CWE-434 (unrestricted upload of a file with a dangerous type) and carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so valid credentials or a self-registration path are required rather than unauthenticated access, and installations already on 10.0.11 or later are outside the affected range. No public exploit has been identified at time of analysis; TR-CERT (Turkish national CERT) is the reporting and reference source. This is a genuine high-priority issue for organizations running the affected product.
Authenticated path traversal in Bimser eBA Plus Document and Workflow Management System (versions 6.7.141 up to but not including 10.0.11) allows a remote attacker holding a valid low-privilege account to read files outside the intended restricted directory, resulting in high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The vulnerability is a CWE-22 improper limitation of a pathname to a restricted directory, reported by TR-CERT, and exploitation requires an authenticated session - anonymous access is not indicated by the assessed vector. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, so this is a moderate-severity, credentialed information-disclosure issue rather than a top-priority emergency; because the vector is PR:L, only confirmed as an authenticated attack path. Deployments on 10.0.11 or later are not affected.
Stored cross-site scripting (XSS) in eBA Plus Document and Workflow Management System (versions 6.7.141 up to but not including 10.0.11) allows an authenticated low-privilege user to persist script payloads into document, form, or workflow content that other users later render in their browser, where the script executes in the victim's session context. The assessed vector confirms the practical constraints: a valid account is required (PR:L) and a separate user must open the tainted record for the payload to fire (UI:R), with the impact crossing a trust boundary (S:C) so the script can act as the viewing user - this is therefore not exploitable against unauthenticated or default anonymously accessible deployments. Reported through TR-CERT (TR-26-1197), the issue carries a moderate CVSS base score of 5.4, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.