Flipper
Monthly
Path traversal in OpenText Flipper 3.1.2 lets an unauthenticated remote actor supply an externally controlled file name or path that is not constrained to the intended directory, allowing files hosted on the server to be read - though only with the low-impact, partial disclosure reflected in the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N vector. Exploitation generally depends on a victim triggering the crafted request (passive user interaction, UI:P in the CVSS 4.0 vector), and the score of 5.3 with an EPSS of 0.29% (20th percentile) marks this as a medium-severity, lower-priority issue rather than an urgent one. There is no CISA KEV entry and no public exploit identified at time of analysis.
Low-privilege users of OpenText Flipper 3.1.2 can bypass intended access controls to interact with the backend API without sufficient privileges, but exploitation requires adjacent-network access, a specific misconfiguration, and active user interaction. The vendor-assigned CVSS 4.0 base score is 1.0, reflecting minimal confidentiality, integrity, and availability impact; no public exploit or active exploitation has been identified at time of analysis, and the EPSS score is 0.26% (16th percentile). This is a low-priority issue across all signals.
Authenticated low-privilege users of OpenText Flipper 3.1.2 can inject Hibernate Query Language (HQL) expressions into the application's query processor, allowing them to bypass intended query logic and extract limited amounts of data from the underlying database. Exploitation is constrained by adjacent-network access (AV:A), a specific deployment precondition (AT:P), and required user interaction (UI:A), and the assessed impact is confined to low confidentiality, integrity, and availability effects within the Flipper system scope only. EPSS is low at 0.36% (27th percentile), and no public exploit code or CISA KEV entry has been identified, so this remains a low-priority issue.
Information disclosure in OpenText Flipper 3.1.2 allows unauthenticated remote attackers to use absolute path traversal to read files accessible to the Flipper service account, though exploitation requires passive user interaction and is therefore not fully automated. The assessment is moderate severity, with low confidentiality impact (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N); no public exploit was identified and EPSS is only 0.39% (31st percentile), so this is not a top-tier priority. Only version 3.1.2 is listed as affected.
Low-privilege users of OpenText Flipper 3.1.2 can elevate privileges within the application due to insufficient granularity of access control (CWE-1220). Exploitation requires an authenticated foothold, high attack complexity, and user interaction, with impact limited to low-severity effects on confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the EPSS score is 0.28%, indicating a low likelihood of exploitation, consistent with a low-priority risk assessment.
Path traversal in OpenText Flipper 3.1.2 lets an application user submit a stored local file path through the product's document-storage feature and then retrieve that file from the underlying system by requesting the saved document ID. Exploitation is not unauthenticated in practice: the documented workflow requires an account able to create stored documents, so the independent assessment rates the vector as PR:L rather than the vendor's PR:N, and the resulting impact is limited to reading files the Flipper service account can access, with no write or code-execution impact described. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.29% (20th percentile), making this a medium-severity information-disclosure issue with limited real-world urgency.
Path traversal in OpenText Flipper 3.1.2 lets an unauthenticated remote actor supply an externally controlled file name or path that is not constrained to the intended directory, allowing files hosted on the server to be read - though only with the low-impact, partial disclosure reflected in the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N vector. Exploitation generally depends on a victim triggering the crafted request (passive user interaction, UI:P in the CVSS 4.0 vector), and the score of 5.3 with an EPSS of 0.29% (20th percentile) marks this as a medium-severity, lower-priority issue rather than an urgent one. There is no CISA KEV entry and no public exploit identified at time of analysis.
Low-privilege users of OpenText Flipper 3.1.2 can bypass intended access controls to interact with the backend API without sufficient privileges, but exploitation requires adjacent-network access, a specific misconfiguration, and active user interaction. The vendor-assigned CVSS 4.0 base score is 1.0, reflecting minimal confidentiality, integrity, and availability impact; no public exploit or active exploitation has been identified at time of analysis, and the EPSS score is 0.26% (16th percentile). This is a low-priority issue across all signals.
Authenticated low-privilege users of OpenText Flipper 3.1.2 can inject Hibernate Query Language (HQL) expressions into the application's query processor, allowing them to bypass intended query logic and extract limited amounts of data from the underlying database. Exploitation is constrained by adjacent-network access (AV:A), a specific deployment precondition (AT:P), and required user interaction (UI:A), and the assessed impact is confined to low confidentiality, integrity, and availability effects within the Flipper system scope only. EPSS is low at 0.36% (27th percentile), and no public exploit code or CISA KEV entry has been identified, so this remains a low-priority issue.
Information disclosure in OpenText Flipper 3.1.2 allows unauthenticated remote attackers to use absolute path traversal to read files accessible to the Flipper service account, though exploitation requires passive user interaction and is therefore not fully automated. The assessment is moderate severity, with low confidentiality impact (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N); no public exploit was identified and EPSS is only 0.39% (31st percentile), so this is not a top-tier priority. Only version 3.1.2 is listed as affected.
Low-privilege users of OpenText Flipper 3.1.2 can elevate privileges within the application due to insufficient granularity of access control (CWE-1220). Exploitation requires an authenticated foothold, high attack complexity, and user interaction, with impact limited to low-severity effects on confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the EPSS score is 0.28%, indicating a low likelihood of exploitation, consistent with a low-priority risk assessment.
Path traversal in OpenText Flipper 3.1.2 lets an application user submit a stored local file path through the product's document-storage feature and then retrieve that file from the underlying system by requesting the saved document ID. Exploitation is not unauthenticated in practice: the documented workflow requires an account able to create stored documents, so the independent assessment rates the vector as PR:L rather than the vendor's PR:N, and the resulting impact is limited to reading files the Flipper service account can access, with no write or code-execution impact described. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.29% (20th percentile), making this a medium-severity information-disclosure issue with limited real-world urgency.