GitHub Advisoryadvisory · Maven

GHSA-7hjp-97g3-rq93 Path Traversal in minsoft:ms-mcms

HIGH Published 2018-11-01 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-18831
Ecosystem
Maven
Packages
net.mingsoft:ms-mcms
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• Maven net.mingsoft:ms-mcms: <= 4.6.5 (no fix yet)

Description

An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter.

Related

Alias · CVE (1)

  • CVE-2018-18831 An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References