GitHub Advisoryadvisory · Maven

GHSA-vp62-m958-qj8c Gravitee API Management contains Path Traversal

HIGH Published 2023-01-04 Modified 2023-01-23 Official page ↗
Aliases
CVE-2022-38723
Ecosystem
Maven
Packages
io.gravitee.apim:gravitee-api-management
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-79
Reviewed
2023-01-06

Affected packages

• Maven io.gravitee.apim:gravitee-api-management: < 3.15.13 → fixed in 3.15.13

Description

This CVE addresses the partial fix for CVE-2019-25075 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary files via a /management/users/register request. A patch was published in 2019 for this vulnerability but did not appear to have solved the issue. Version 3.15.13 did remove the flaw.

Related

Alias · CVE (1)

  • CVE-2022-38723 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References