GHSA-vjw7-6gfq-6wf5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vjw7-6gfq-6wf5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-vjw7-6gfq-6wf5/GHSA-vjw7-6gfq-6wf5.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vjw7-6gfq-6wf5
- Aliases
- Published
- 2022-02-10T20:28:57Z
- Modified
- 2023-11-08T04:01:25.474533Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Path Traversal in Eclipse Vert
- Details
-
In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4, 4.0.0-milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
- Database specific
{ "nvd_published_at": "2020-10-15T21:15:00Z", "github_reviewed_at": "2021-04-22T22:08:15Z", "severity": "CRITICAL", "github_reviewed": true, "cwe_ids": [ "CWE-22", "CWE-23" ] }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2019-17640
- https://github.com/vert-x3/vertx-web/commit/b12f7c4c6576a8adc3f683b2899de4b0e7d099e4
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416
- https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941@%3Ccommits.servicecomb.apache.org%3E
- https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d@%3Ccommits.pulsar.apache.org%3E
- https://mvnrepository.com/artifact/io.vertx/vertx-web
Affected packages
Maven / io.vertx:vertx-web
Package
- Name
- io.vertx:vertx-web
- View open source insights on deps.dev
- Purl
- pkg:maven/io.vertx/vertx-web
Affected versions
3.*
3.0.0
3.1.0
3.2.0
3.2.1
3.3.0.CR1
3.3.0.CR2
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0.Beta1
3.4.0
3.4.1
3.4.2
3.5.0.Beta1
3.5.0
3.5.1
3.5.2.CR1
3.5.2.CR2
3.5.2.CR3
3.5.2
3.5.3.CR1
3.5.3
3.5.4
3.6.0.CR1
3.6.0.CR2
3.6.0
3.6.1
3.6.2
3.6.3
3.7.0
3.7.1
3.8.0
3.8.1
3.8.2
3.8.3
3.8.3-01
3.8.4
3.8.5
3.9.0
3.9.1
3.9.2
3.9.3