Path traversal in B. Braun Melsungen AG OnlineSuite
Priority MEDIUM 46CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files.
Why it matters now
EPSS 0.02033 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| B. Braun Melsungen AG | OnlineSuite | AP – 3.0 | — | No fix listed | CNA |
- OnlineSuite VendorB. Braun Melsungen AG Affected AP – 3.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bbraun:onlinesuite_application_package:*:*:*:*:*:*:*:* | up to 3.0 | Vulnerable | B. Braun Melsungen AG |
- cpe:2.3:a:bbraun:onlinesuite_application_package:*:*:*:*:*:*:*:* Versions up to 3.0 Vulnerable ·B. Braun Melsungen AG
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25172
- 2026-10-03 Alias added: GHSA-w64q-vf23-c7h3
References
More B. Braun Melsungen AG Onlinesuite Application Package vulnerabilities
- TI-2020-15412 CSV injection in B. Braun Melsungen AG OnlineSuite CVSS 3.1HIGH 7.8
- TI-2020-15416 Uncontrolled search path in B. Braun Melsungen AG OnlineSuite CVSS 3.1HIGH 7.8
Sources
- CVE-2020-25172 · CVE Program
- CVE-2020-25172 · NVD
- FIRST EPSS
- GHSA-w64q-vf23-c7h3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences