B Braun Melsungen Ag Onlinesuite vulnerabilities

CVE-2020-25172 [CRITICAL] CWE-23 CVE-2020-25172: A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unaut A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files.

CVE-2025-3322 [CRITICAL] CWE-917 CVE-2025-3322: An improper neutralization of inputs used in expression language allows remote code execution with t An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server.

CVE-2025-3365 [CRITICAL] CWE-23 CVE-2025-3365: A missing protection against path traversal allows to access any file on the server. A missing protection against path traversal allows to access any file on the server.

CVE-2025-3321 [CRITICAL] CWE-798 CVE-2025-3321: A predefined administrative account is not documented and cannot be deactivated. This account cannot A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server.

CVE-2020-25170 [HIGH] CWE-1236 CVE-2020-25170: An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Vers An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export.

CVE-2020-25174 [HIGH] CWE-427 CVE-2020-25174: A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local at A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user.