Описание
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.
Ссылки
- Issue TrackingVendor Advisory
- ExploitVendor Advisory
- Issue TrackingVendor Advisory
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 3.0.0 (включая) до 3.5.3 (включая)
Одновременно
cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
EPSS
Процентиль: 76%
0.00926
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-22
Связанные уязвимости
CVSS3: 9.8
github
больше 7 лет назад
Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
EPSS
Процентиль: 76%
0.00926
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-22