CVE-2025-8516 (CNNVD-202508-224)
中文标题:
Kingdee Cloud-Starry-Sky Enterprise Edition 路径遍历漏洞
英文标题:
Kingdee Cloud-Starry-Sky Enterprise Edition IIS-K3CloudMiniApp FileUploadAction.class path traversal
漏洞描述
中文描述:
Kingdee Cloud-Starry-Sky Enterprise Edition是中国金蝶（Kingdee）公司的一个面向成长型企业的数字化转型解决方案。 Kingdee Cloud-Starry-Sky Enterprise Edition 8.2及之前版本存在路径遍历漏洞，该漏洞源于对参数filePath的错误操作导致路径遍历。
英文描述:
A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file K3Cloud\BBCMallSite\WEB-INF\lib\Kingdee.K3.O2O.Base.WebApp.jar!\kingdee\k3\o2o\base\webapp\action\FileUploadAction.class of the component IIS-K3CloudMiniApp. The manipulation of the argument filePath leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. It is suggested to install a patch to address this issue. The vendor recommends as a short-term measure to "[t]emporarily disable external network access to the Kingdee Cloud Galaxy Retail System or set up an IP whitelist for access control." The long-term remediation will be: "Install the security patch provided by the Starry Sky system, with the specific solutions being: i) Adding authentication to the vulnerable CMKAppWebHandler.ashx interface; ii) Removing the file reading function."
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Kingdee | Cloud-Starry-Sky Enterprise Edition | 8.0 | - | - |
cpe:2.3:a:kingdee:cloud-starry-sky_enterprise_edition:8.0:*:*:*:*:*:*:*
|
| Kingdee | Cloud-Starry-Sky Enterprise Edition | 8.1 | - | - |
cpe:2.3:a:kingdee:cloud-starry-sky_enterprise_edition:8.1:*:*:*:*:*:*:*
|
| Kingdee | Cloud-Starry-Sky Enterprise Edition | 8.2 | - | - |
cpe:2.3:a:kingdee:cloud-starry-sky_enterprise_edition:8.2:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
CVSS评分详情
4.0 (cna)
MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
3.0 (cna)
MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
2.0 (cna)
MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-8516 |
2025-11-11 15:23:37 | 2025-11-11 07:40:53 |
| NVD | nvd_CVE-2025-8516 |
2025-11-11 15:00:58 | 2025-11-11 07:48:39 |
| CNNVD | cnnvd_CNNVD-202508-224 |
2025-11-11 15:13:01 | 2025-11-11 08:00:06 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 路径遍历
- cnnvd_id: 未提取 -> CNNVD-202508-224
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']