Описание
util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored in an unintended directory because of Directory Traversal.
Ссылки
- Issue TrackingThird Party Advisory
- Issue TrackingThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:liulishuo:filedownloader:1.7.3:*:*:*:*:*:*:*
EPSS
Процентиль: 64%
0.00459
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-22
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the file can be stored in an unintended directory because of Directory Traversal.
EPSS
Процентиль: 64%
0.00459
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-22