CVE-2026-97179

Description

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of the argument fileUrl leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-200, CWE-284
Reserved: 2026-09-24
Published: 2026-09-24 10:30 UTC
Last updated: 2026-09-24 15:16 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97179.json

Affected products (1)

Vendor	Product	Versions	Platforms
n/a	O2OA	`9.5.0` (affected), `9.5.1` (affected), `9.5.2` (affected), `9.5.3` (affected), `10.0.0` (affected), `10.0.1` (affected), `10.0.2` (affected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

VDB-409281 | O2OA Cipher Connection CipherConnectionAction.java list information disclosure vdb-entrytechnical-description
VDB-409281 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
CVE-2026-97179 | CVE Analysis and Report third-party-advisory
Submit #907501 | Zhejiang Landzone N&T Corporation Limited o2oa 10.0.2 Least Privilege Violation third-party-advisory
https://github.com/2H-K/myvuls/issues/3 exploitissue-tracking

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-97179.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97179",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T15:14:49.203301Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T15:16:40.771Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:o2oa:o2oa:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Cipher Connection Handler"
          ],
          "product": "O2OA",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.0"
            },
            {
              "status": "affected",
              "version": "9.5.1"
            },
            {
              "status": "affected",
              "version": "9.5.2"
            },
            {
              "status": "affected",
              "version": "9.5.3"
            },
            {
              "status": "affected",
              "version": "10.0.0"
            },
            {
              "status": "affected",
              "version": "10.0.1"
            },
            {
              "status": "affected",
              "version": "10.0.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "hacja (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of the argument fileUrl leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T10:30:13.069Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-409281 | O2OA Cipher Connection CipherConnectionAction.java list information disclosure",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/409281"
        },
        {
          "name": "VDB-409281 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/409281/cti"
        },
        {
          "name": "CVE-2026-97179 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-97179"
        },
        {
          "name": "Submit #907501 | Zhejiang Landzone N&T Corporation Limited o2oa 10.0.2 Least Privilege Violation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/907501"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/2H-K/myvuls/issues/3"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-24T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-24T08:05:33.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "O2OA Cipher Connection CipherConnectionAction.java list information disclosure",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-97179",
    "datePublished": "2026-09-24T10:30:13.069Z",
    "dateReserved": "2026-09-24T06:00:26.657Z",
    "dateUpdated": "2026-09-24T15:16:40.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}