Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-12542US | critical9.8 | Exploit | ||
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not proper… | ||||
02
references
External citations — patches, advisories, analysis.
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=539171WEB
- https://github.com/advisories/GHSA-h39x-m55c-v55hADVISORY
- https://github.com/vert-x3/vertx-webPACKAGE
- https://github.com/vert-x3/vertx-web/commit/57a65dce6f4c5aa5e3ce7288685e7f3447eb8f3bWEB
- https://github.com/vert-x3/vertx-web/issues/1025WEB
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3EWEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-12542ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan