GHSA-4m9r-5gqp-7j82HighCVSS 7.5

High severity vulnerability that affects org.dspace:dspace-xmlui

Published
October 19, 2018
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2016-10726 →

📋 Description

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

🎯 Affected products3

  • maven/org.dspace:dspace-xmlui:>= 4.0, < 4.5
  • maven/org.dspace:dspace-xmlui:>= 5.0, < 5.5
  • maven/org.dspace:dspace-xmlui:< 3.6

🔗 References (5)