GitHub Advisoryadvisory · Maven

GHSA-4m9r-5gqp-7j82 High severity vulnerability that affects org.dspace:dspace-xmlui

HIGH Published 2018-10-19 Modified 2021-06-11 Official page ↗
Aliases
CVE-2016-10726
Ecosystem
Maven
Packages
org.dspace:dspace-xmlui
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• Maven org.dspace:dspace-xmlui: >= 4.0, < 4.5 → fixed in 4.5 • Maven org.dspace:dspace-xmlui: >= 5.0, < 5.5 → fixed in 5.5 • Maven org.dspace:dspace-xmlui: < 3.6 → fixed in 3.6

Description

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

Related

Alias · CVE (1)

  • CVE-2016-10726 The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References