GitHub Advisoryadvisory · Maven

GHSA-6h58-c7r7-g2hw UberFire Framework Improperly Restricts Paths

MEDIUM Published 2022-05-14 Modified 2023-08-16 Official page ↗
Aliases
CVE-2014-8114
Ecosystem
Maven
Packages
org.uberfire:uberfire-parent
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2023-08-16

Affected packages

• Maven org.uberfire:uberfire-parent: >= 0.3.0.Beta5, <= 0.3.1.Final (no fix yet)

Description

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.

Related

Alias · CVE (1)

  • CVE-2014-8114 The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References