GitHub Advisoryadvisory · Maven

GHSA-q446-82vq-w674 Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch

MEDIUM Published 2022-05-13 Modified 2022-07-06 Official page ↗
Aliases
CVE-2016-5725
Ecosystem
Maven
Packages
com.jcraft:jsch
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2022-07-06

Affected packages

• Maven com.jcraft:jsch: < 0.1.54 → fixed in 0.1.54

Description

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.

Related

Alias · CVE (1)

  • CVE-2016-5725 Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References