CVEvulnerability
CVE-2014-8114
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-02-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.
Affected configurations
• redhat uberfire 0.3.0
• redhat uberfire 0.3.1
• redhat uberfire 0.3.2
• redhat uberfire 0.3.3
Related
Weakness · not in database (1)
References
- http://rhn.redhat.com/errata/RHSA-2015-0234.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0235.html Vendor Advisory
- http://www.securityfocus.com/bid/88199 www.securityfocus.com
- https://github.com/uberfire/uberfire/commit/21ec50eb15 github.com
- http://rhn.redhat.com/errata/RHSA-2015-0234.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0235.html Vendor Advisory
- http://www.securityfocus.com/bid/88199 www.securityfocus.com
- https://github.com/uberfire/uberfire/commit/21ec50eb15 github.com