GHSA-6h58-c7r7-g2hwMedium

UberFire Framework Improperly Restricts Paths

Published
May 14, 2022
Last Modified
August 16, 2023

🔗 CVE IDs covered (1)

CVE-2014-8114 →

📋 Description

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.

🎯 Affected products1

  • maven/org.uberfire:uberfire-parent:>= 0.3.0.Beta5, <= 0.3.1.Final

🔗 References (6)