GHSA-q446-82vq-w674

Suggest an improvement
Source
https://github.com/advisories/GHSA-q446-82vq-w674
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-q446-82vq-w674/GHSA-q446-82vq-w674.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q446-82vq-w674
Aliases
Published
2022-05-13T01:09:33Z
Modified
2024-02-20T05:33:38.873866Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch
Details

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.

Database specific 
{
    "nvd_published_at": "2017-01-19T22:59:00Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T19:44:21Z"
}
References

Affected packages

Maven / com.jcraft:jsch

Package

Name
com.jcraft:jsch
View open source insights on deps.dev
Purl
pkg:maven/com.jcraft/jsch

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.1.54

Affected versions

0.*

0.1.23
0.1.24
0.1.25
0.1.27
0.1.29
0.1.31
0.1.38
0.1.41
0.1.42
0.1.43
0.1.43-1
0.1.44
0.1.44-1
0.1.45
0.1.46
0.1.47
0.1.48
0.1.49
0.1.50
0.1.51
0.1.52
0.1.53

Database specific 

{
    "last_known_affected_version_range": "<= 0.1.53"
}