GitHub Advisoryadvisory · Maven

GHSA-fjw4-39pg-vf4f Apache Karaf vulnerable to relative path traversal

MEDIUM Published 2022-05-24 Modified 2022-11-07 Official page ↗
Aliases
CVE-2019-0226
Ecosystem
Maven
Packages
org.apache.karaf.config:org.apache.karaf.config.core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2022-11-07

Affected packages

• Maven org.apache.karaf.config:org.apache.karaf.config.core: < 4.2.5 → fixed in 4.2.5

Description

Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. User should upgrade to Apache Karaf 4.2.5 or later.

Related

Alias · CVE (1)

  • CVE-2019-0226 Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References