GitHub Advisoryadvisory · Maven

GHSA-h6p6-fc4w-cqhx Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow

MEDIUM Published 2022-05-17 Modified 2022-07-06 Official page ↗
Aliases
CVE-2014-7816
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2022-07-06

Affected packages

• Maven io.undertow:undertow-core: >= 1.0.0, < 1.0.17 → fixed in 1.0.17 • Maven io.undertow:undertow-core: >= 1.1.0.Beta1, < 1.1.0.CR5 → fixed in 1.1.0.CR5 • Maven io.undertow:undertow-core: >= 1.2.0.Beta1, < 1.2.0.Beta3 → fixed in 1.2.0.Beta3

Description

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.

Related

Alias · CVE (1)

  • CVE-2014-7816 Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References