GitHub Advisoryadvisory · Maven

GHSA-23gj-368h-92pq Path Traversal in DKPro Core

HIGH Published 2019-05-29 Modified 2021-08-04 Official page ↗
Aliases
CVE-2019-11082
Ecosystem
Maven
Packages
de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2019-05-16

Affected packages

• Maven de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl: <= 1.10.0 (no fix yet)

Description

core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.

Related

Alias · CVE (1)

  • CVE-2019-11082 core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References