GHSA-pffw-p2q5-w6vh

Source

https://github.com/advisories/GHSA-pffw-p2q5-w6vh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/04/GHSA-pffw-p2q5-w6vh/GHSA-pffw-p2q5-w6vh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pffw-p2q5-w6vh

Aliases

CVE-2019-0225

Published

2019-04-08T16:23:36Z

Modified

2023-11-08T04:00:32.030969Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Improper Limitation of a Pathname ('Path Traversal') in org.apache.jspwiki:jspwiki-war

Details

A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T21:49:01Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Maven / org.apache.jspwiki:jspwiki-war

Package

Name: org.apache.jspwiki:jspwiki-war; View open source insights on deps.dev
Purl: pkg:maven/org.apache.jspwiki/jspwiki-war

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.9.0

Fixed

2.11.0.M3

Affected versions

2.*

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.11.0.M1

2.11.0.M2

Database specific

{
    "last_known_affected_version_range": "<= 2.11.0.M2"
}