GitHub Advisoryadvisory · Maven

GHSA-g3hr-p86p-593h OpenAPI Generator Online - Arbitrary File Read/Delete

HIGH Published 2024-05-28 Modified 2024-05-28 Official page ↗
Aliases
CVE-2024-35219
Ecosystem
Maven
Packages
org.openapitools:openapi-generator-online
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Weaknesses
CWE-22
Reviewed
2024-05-28

Affected packages

• Maven org.openapitools:openapi-generator-online: < 7.6.0 → fixed in 7.6.0

Description

Impact Attackers can exploit the vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. Patches The issue was fixed via https://github.com/OpenAPITools/openapi-generator/pull/18652 (included in v7.6.0 release) by removing the usage of the `outputFolder` option. Workarounds No workaround available. References No other reference available.

Related

Alias · CVE (1)

  • CVE-2024-35219 OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References