OpenAPI Generator Online - Arbitrary File Read/Delete
### Impact Attackers can exploit the vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. ### Patches The issue was fixed via https://github.com/OpenAPITools/openapi-generator/pull/18652 (included in v7.6.0 release) by removing the usage of the `outputFolder` option. ### Workarounds No workaround available. ### References No other reference available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-35219US | — | — | ||
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/OpenAPITools/openapi-generatorPACKAGE
- https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800dWEB
- https://github.com/OpenAPITools/openapi-generator/pull/18652WEB
- https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593hWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-35219ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan