CVE-2024-8262

CriticalUpdated

Published: 03 March 2025

Published

03 March 2025

Modified

02 June 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0046 64.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-8262 is a critical-severity Path Traversal (CWE-22) vulnerability in Prolizyazilim Student Affairs Information System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-8262 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified under CWE-22, in Proliz Software OBS. It affects versions of OBS prior to 24.0927. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical), reflecting network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), no user interaction (UI:N), and high impacts on confidentiality (C:H), integrity (I:H), and availability (A:H).

Remote attackers require no authentication or privileges to exploit this path traversal flaw over the network. Successful exploitation allows arbitrary file read, write, or execution on the targeted system by manipulating pathnames to escape restricted directories, potentially leading to full system compromise.

Mitigation details are available in the advisory published by the Turkish National Cyber Incident Response Center (USOM) at https://www.usom.gov.tr/bildirim/tr-25-0049. Users should upgrade to OBS version 24.0927 or later to address the issue.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-5592

Vulnerability details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Proliz Software OBS allows Path Traversal. This issue affects OBS: before 24.0927.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The path traversal vulnerability (CWE-22) in a publicly accessible application allows remote unauthenticated attackers to read, write, or execute arbitrary files, directly mapping to exploitation of public-facing applications for initial access and full system compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0