Approved changes feed: RSS · Atom
cpe:2.3:a:eptura:archibus:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Eptura (1486188f-56a6-5710-94f9-31a35d1e10d6) |
|---|---|
| Product | Archibus (cc410eb5-e0a0-51b4-9a91-4c3f63203dcf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-107188 |
vulnerable | 2026-11-03 10:15:59.439789 |
Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
CRITICAL (9.6)
A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication.
Published: 2026-10-19T16:37:39.202Z
Updated: 2026-10-20T19:30:58.437Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-107187 |
vulnerable | 2026-11-03 10:15:59.078698 |
Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
HIGH (8.5)
A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.
Published: 2026-10-19T16:35:01.728Z
Updated: 2026-10-20T19:30:36.980Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-107186 |
vulnerable | 2026-11-03 10:15:58.997633 |
Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
HIGH (8.6)
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.
Published: 2026-10-19T16:32:05.063Z
Updated: 2026-10-20T19:30:17.854Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.