GitHub Advisoryadvisory · Maven

GHSA-xjhv-p3fv-x24r In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack

HIGH Published 2023-11-15 Modified 2024-04-26 Official page ↗
Aliases
CVE-2023-34062
Ecosystem
Maven
Packages
io.projectreactor.netty:reactor-netty-http
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-11-15

Affected packages

• Maven io.projectreactor.netty:reactor-netty-http: >= 1.1.0, < 1.1.13 → fixed in 1.1.13 • Maven io.projectreactor.netty:reactor-netty-http: >= 1.0.0, < 1.0.39 → fixed in 1.0.39

Description

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

Related

Alias · CVE (1)

  • CVE-2023-34062 In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References