CVE-2012-1617

CVE-2012-1617 is a medium-severity vulnerability in Juan Ramon Osclass with a CVSS 2.0 base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.

Key facts

• Severity: Medium (CVSS 2.0 base score 6.4)
• EPSS exploit prediction: 10% (95th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-22
• Affected product: Juan Ramon Osclass
• Published: 2012-09-26
• Last modified: 2026-06-16

Description

Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files.

Frequently asked questions

What is CVE-2012-1617?

Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files.

How severe is CVE-2012-1617?

CVE-2012-1617 has a CVSS 2.0 base score of 6.4, rated medium severity.

Is CVE-2012-1617 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 10% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2012-1617?

CVE-2012-1617 primarily affects Juan Ramon Osclass. In total, 22 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2012-1617?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2012-1617 published?

CVE-2012-1617 was published on 2012-09-26 and last updated on 2026-06-16.

References

• http://archives.neohapsis.com/archives/bugtraq/2012-03/0024.html
• http://osclass.org/2012/03/05/osclass-2-3-6/
• http://secunia.com/advisories/48284
• http://www.codseq.it/advisories/osclass_directory_traversal_vulnerability
• http://www.openwall.com/lists/oss-security/2012/04/02/1
• http://www.openwall.com/lists/oss-security/2012/04/02/6
• http://www.openwall.com/lists/oss-security/2012/04/03/1
• http://www.openwall.com/lists/oss-security/2012/04/04/7
• http://www.securityfocus.com/bid/52336
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73754
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73755
• https://github.com/osclass/OSClass/commit/1e7626f4e1a26371480989c0b937f107ea9a6d4b
• https://github.com/osclass/OSClass/commit/a40b76695994442644e46e1b776d79660500566a
• https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-1

Affected products (22)

• cpe:2.3:a:juan_ramon:osclass:*:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:1.1:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:1.1:rc:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:1.2:alpha:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:1.2:beta:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:1.2:delta:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.0:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.0:rc:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.1:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.2:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.3:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:juan_ramon:osclass:2.3.4:*:*:*:*:*:*:*

More vulnerabilities in Juan Ramon Osclass

• CVE-2012-0974 — Medium (CVSS 4.3): Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in…

All CVEs affecting Juan Ramon Osclass →

Other CWE-22 (Path Traversal) vulnerabilities

• CVE-2026-48282 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted…
• CVE-2026-54917 — Critical (CVSS 10.0): SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the…
• CVE-2026-11429 — Critical (CVSS 10.0): Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file…
• CVE-2026-34909 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to…
• CVE-2026-7411 — Critical (CVSS 10.0): In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel…
• CVE-2026-36767 — Critical (CVSS 10.0): A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary…

Browse all CWE-22 (Path Traversal) vulnerabilities →