GHSA-x8q6-cchr-p7m6

Suggest an improvement
Source
https://github.com/advisories/GHSA-x8q6-cchr-p7m6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-x8q6-cchr-p7m6/GHSA-x8q6-cchr-p7m6.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-x8q6-cchr-p7m6
Aliases
Published
2025-02-23T15:30:58Z
Modified
2025-02-24T18:57:07Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Solon Path Traversal
Details

A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.9 is able to address this issue. The name of the patch is f46e47fd1f8455b9467d7ead3cdb0509115b2ef1. It is recommended to upgrade the affected component.

Database specific 
{
    "cwe_ids":  [
        "CWE-23"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-02-24T18:31:10Z",
    "nvd_published_at":  "2025-02-23T13:15:09Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.noear:solon-web-staticfiles

Package

Name
org.noear:solon-web-staticfiles
View open source insights on deps.dev
Purl
pkg:maven/org.noear/solon-web-staticfiles

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.9

Affected versions

2.*
2.9.2-M1
2.9.2-M2
2.9.2
2.9.3
2.9.4
2.9.5-M1
2.9.5-M2
3.*
3.0.0-M1
3.0.0-M2
3.0.0-M3
3.0.0-M4
3.0.0-RC
3.0.0-RC2
3.0.0-RC3
3.0.0
3.0.1-M1
3.0.1-M2
3.0.1-M3
3.0.1
3.0.2-M1
3.0.2-M2
3.0.2-M3
3.0.2-M4
3.0.2-M5
3.0.2-M6
3.0.2-M7
3.0.2-RC
3.0.2-RC2
3.0.2-RC3
3.0.2
3.0.3-M1
3.0.3-M2
3.0.3-M3
3.0.3-M4
3.0.3-RC
3.0.3
3.0.4-M1
3.0.4-M2
3.0.4-RC
3.0.4-RC2
3.0.4
3.0.4.1
3.0.5-M1
3.0.5-M2
3.0.5-M3
3.0.5
3.0.6-M1
3.0.6-M2
3.0.6-M3
3.0.6-RC
3.0.6-RC2
3.0.6
3.0.7-M1
3.0.7
3.0.8-M1
3.0.8-M2
3.0.8
3.0.9-M1
3.0.9-M2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-x8q6-cchr-p7m6/GHSA-x8q6-cchr-p7m6.json"