What is GHSA-h6p6-fc4w-cqhx?

GHSA-h6p6-fc4w-cqhx is a security advisory published by GitHub Security Advisories with Medium severity. Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow

Which CVE IDs does GHSA-h6p6-fc4w-cqhx cover?

GHSA-h6p6-fc4w-cqhx covers the following CVE IDs: CVE-2014-7816. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-h6p6-fc4w-cqhx?

GHSA-h6p6-fc4w-cqhx affects 3 products, including: maven/io.undertow:undertow-core:\u003e= 1.0.0, \u003c 1.0.17; maven/io.undertow:undertow-core:\u003e= 1.1.0.Beta1, \u003c= 1.1.0.CR4; maven/io.undertow:undertow-core:\u003e= 1.2.0.Beta1, \u003c= 1.2.0.Beta2.

GHSA-h6p6-fc4w-cqhxMedium

Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2014-7816 →

📋 Description

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.

🎯 Affected products3

maven/io.undertow:undertow-core:>= 1.0.0, < 1.0.17
maven/io.undertow:undertow-core:>= 1.1.0.Beta1, <= 1.1.0.CR4
maven/io.undertow:undertow-core:>= 1.2.0.Beta1, <= 1.2.0.Beta2

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2014-7816
https://bugzilla.redhat.com/show_bug.cgi?id=1157478
https://issues.jboss.org/browse/UNDERTOW-338
https://issues.jboss.org/browse/WFLY-4020
http://seclists.org/oss-sec/2014/q4/830
http://www.securityfocus.com/bid/71328
https://github.com/advisories/GHSA-h6p6-fc4w-cqhx