GitHub Advisoryadvisory · Maven

GHSA-hcwx-7q5v-vc67 Path Traversal in OWASP Dependency-Check

HIGH Published 2022-05-14 Modified 2022-11-01 Official page ↗

Aliases: CVE-2018-12036
Ecosystem: Maven
Packages: org.owasp:dependency-check-maven
Severity: High
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-22
Reviewed: 2022-11-01

Affected packages

• Maven org.owasp:dependency-check-maven: < 3.2.0 → fixed in 3.2.0

Description

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.

Related

Alias · CVE (1)

CVE-2018-12036 OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal… vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References