Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote aut

Summary

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."

Timeline

1. Mar 31, 2016Public exploit on Exploit-DB

   EDB-39643

2. Apr 11, 2016, 2:00 PM UTCCVE published
3. Aug 5, 2024, 10:30 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• org.apache.portals.jetspeed-2:jetspeedMaven

  fixed in 2.3.1

References 8