CVE-2012-2315: admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated…

PriorityP431medium4CVSS 2.0

AVNACLAuSCNIPAN

EXPLOIT

EPSS

6.22%

92.6th percentile

admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authenticated users to assign administrator privileges to arbitrary users via the userEdit action.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
openkm	openkm	<= 5.1.7	—
openkm	openkm	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.