MPXJ has a Potential Path Traversal Vulnerability
### Impact The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. ### Patches The issue is addressed in MPXJ version 13.5.1 ### Workarounds Do not pass zip files to MPXJ. ### References N/A ### Credits Issue report and patch provided by yyjLF and sprinkle
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-49771US | — | — | ||
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is in… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-j945-c44v-97g6ADVISORY
- https://github.com/joniles/mpxjPACKAGE
- https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0WEB
- https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mpxj/CVE-2024-49771.ymlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-49771ADVISORY
- https://pypi.org/project/mpxjPACKAGE
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan