Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch

🗓️ 13 May 2022 01:09:33Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 32 Views

Improper pathname limitation in JCraft JSc

Reporter	Title	Published	Views	Family All 49
0day.today	JCraft / JSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal	22 Sep 201600:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM System Networking Switch Center is affected by a Jsch vulnerability (CVE-2016-5725)	31 Jan 201902:25	–	ibm
IBM Security Bulletins	Security Bulletin: JSch could allow a remote attacker to traverse directories on the system which affects watsonx.data	10 Mar 202518:07	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in IBM WebSphere Application (CVE-2016-5725) affects IBM PowerVM Novalink.	21 Oct 202518:04	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilties have been addressed in IBM Cognos Analytics	13 Sep 201916:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities have been fixed in IBM Security Privileged Identity Manager Appliance.	17 Sep 201915:34	–	ibm
IBM Security Bulletins	Security Bulletin: ITCAM for Transactions affected by the Security vulnerability CVE-2016-5725 found in jsch-0.1.40.jar	30 Aug 202315:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Fasterxml Jackson,FasterXML Jackson Core,Bouncy Castle Java, Netty,Hibernate Validator,JCraft JSch,Apache Tomcat,Bootstrap might affect IBM Storage Defender Copy Data Management	12 Dec 202515:28	–	ibm
IBM Security Bulletins	Security Bulletin: Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE	29 Mar 202121:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ	20 Feb 202012:42	–	ibm

Vulners

Node

com.jcraft jschRange≤0.1.53maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2016-5725
access	www.access.redhat.com/errata/RHSA-2017:3115
github	www.github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725
lists	www.lists.debian.org/debian-lts-announce/2020/04/msg00017.html
exploit-db	www.exploit-db.com/exploits/40411/
oracle	www.oracle.com/security-alerts/cpuApr2021.html
oracle	www.oracle.com/security-alerts/cpujan2021.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
packetstormsecurity	www.packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html
seclists	www.seclists.org/fulldisclosure/2016/Sep/53

27 Jan 2023 05:02Current

5Medium risk

Vulners AI Score5

CVSS 24.3

CVSS 35.9

EPSS0.26672

directory traversal vulnerability jcraft jsch sftp servers windows channelsftp.overwrite recursive get command