GitHub Advisoryadvisory · Maven

GHSA-9g8w-pjpr-prr4 Path Traversal in io.hawt:project

HIGH Published 2022-05-13 Modified 2022-11-04 Official page ↗
Aliases
CVE-2017-2594
Ecosystem
Maven
Packages
io.hawt:project
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-11-04

Affected packages

• Maven io.hawt:project: < 1.5.0 → fixed in 1.5.0

Description

hawtio before versions 2.0-beta-1, 2.0-beta-2, 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 are vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.

Related

Alias · CVE (1)

  • CVE-2017-2594 hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References