CVE-2019-17640

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-17640
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-17640
Aliases
Published
2020-10-15T21:15:11.427Z
Modified
2026-07-08T20:15:51.770425Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.

References

Affected packages

Git / github.com/eclipse-vertx/vert.x

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-vertx/vert.x
Events
Introduced
05683b353b8ad53d28e9a70f0f0bfc2ce36c083c
Last affected
d4490fed7871b55c3cefa459f622fb22cfead951
Introduced
3daea80a20324bb19e97c8455c648efa62fba104
Last affected
95372a1f8a7ea235415ce746eda91e0243a59307
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.4.0"
        },
        {
            "last_affected": "3.9.4"
        },
        {
            "introduced": "4.0.0-beta1"
        },
        {
            "last_affected": "4.0.0-beta1"
        },
        {
            "introduced": "4.0.0-beta2"
        },
        {
            "last_affected": "4.0.0-beta2"
        },
        {
            "introduced": "4.0.0-beta3"
        },
        {
            "last_affected": "4.0.0-beta3"
        },
        {
            "introduced": "4.0.0-milestone1"
        },
        {
            "last_affected": "4.0.0-milestone1"
        },
        {
            "introduced": "4.0.0-milestone2"
        },
        {
            "last_affected": "4.0.0-milestone2"
        },
        {
            "introduced": "4.0.0-milestone3"
        },
        {
            "last_affected": "4.0.0-milestone3"
        },
        {
            "introduced": "4.0.0-milestone4"
        },
        {
            "last_affected": "4.0.0-milestone4"
        },
        {
            "introduced": "4.0.0-milestone5"
        },
        {
            "last_affected": "4.0.0-milestone5"
        }
    ]
}

Affected versions

3.*
3.4.0
3.4.1
3.4.2
3.5.0
3.5.0.Beta1
3.5.1
3.6.0
3.6.0.CR1
3.6.0.CR2
3.6.1
3.6.2
3.6.3
3.7.0
3.7.1
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
4.*
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-milestone1
4.0.0-milestone2
4.0.0-milestone3
4.0.0-milestone4
4.0.0-milestone5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"

Git / github.com/vert-x3/vertx-web

Affected ranges

Type
GIT
Repo
https://github.com/vert-x3/vertx-web
Events
Introduced
8a11acc912accf4c0661f5c56f1cd387f5200718
Last affected
1258a682e0ec6a695da8b05063afb0ee57a503c9
Introduced
4b8bd2f1053800a3e79152f2f10026942554a44f
Last affected
2e72faef41bec6162023aca898678929064870cd
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.4.0"
        },
        {
            "last_affected": "3.9.4"
        },
        {
            "introduced": "4.0.0-beta1"
        },
        {
            "last_affected": "4.0.0-beta1"
        },
        {
            "introduced": "4.0.0-beta2"
        },
        {
            "last_affected": "4.0.0-beta2"
        },
        {
            "introduced": "4.0.0-beta3"
        },
        {
            "last_affected": "4.0.0-beta3"
        },
        {
            "introduced": "4.0.0-milestone1"
        },
        {
            "last_affected": "4.0.0-milestone1"
        },
        {
            "introduced": "4.0.0-milestone2"
        },
        {
            "last_affected": "4.0.0-milestone2"
        },
        {
            "introduced": "4.0.0-milestone3"
        },
        {
            "last_affected": "4.0.0-milestone3"
        },
        {
            "introduced": "4.0.0-milestone4"
        },
        {
            "last_affected": "4.0.0-milestone4"
        },
        {
            "introduced": "4.0.0-milestone5"
        },
        {
            "last_affected": "4.0.0-milestone5"
        }
    ]
}

Affected versions

3.*
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.6.0
3.6.0.CR1
3.6.0.CR2
3.6.1
3.6.2
3.6.3
3.7.0
3.7.1
3.8.0
3.8.1
3.8.2
3.8.3
3.8.3-01
3.8.4
3.8.5
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
4.*
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-milestone1
4.0.0-milestone2
4.0.0-milestone3
4.0.0-milestone4
4.0.0-milestone5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"