Codehaus-plexus: directory traversal
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.0.24
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- codehaus-plexus
Version range not reported
- Red Hat RHPAM 7.13.1 async
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- plexus-utils
Version range not reported
- maven:3.6/plexus-utils
Version range not reported
- maven:3.8/plexus-utils
Version range not reported
- maven:3.8/plexus-utils
Version range not reported
- plexus-utils
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- codehaus-plexus
Version range not reported
- org.codehaus.plexus-plexus-utils
Version range not reported
- rh-maven36-byte-buddy
Version range not reported
- rh-maven36-maven
Version range not reported
- rh-maven36-maven-archiver
Version range not reported
- rh-maven36-maven-assembly-plugin
Version range not reported
- rh-maven36-maven-compiler-plugin
Version range not reported
- rh-maven36-maven-jar-plugin
Version range not reported
- rh-maven36-maven-plugin-bundle
Version range not reported
- rh-maven36-maven-remote-resources-plugin
Version range not reported
- rh-maven36-maven-shade-plugin
Version range not reported
- rh-maven36-maven-source-plugin
Version range not reported
- rh-maven36-maven-surefire
Version range not reported
- rh-maven36-plexus-utils
Version range not reported
- codehaus-plexus
Version range not reported
- org.codehaus.plexus:plexus-utilsMaven
fixed in 3.0.24