Lucene search

K
osvGoogleOSV:GHSA-5X3V-2GXR-59M2
HistoryJul 01, 2020 - 5:26 p.m.

Directory traversal in Apache RocketMQ

2020-07-0117:26:15
Google
osv.dev
9

0.001 Low

EPSS

Percentile

25.0%

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “…/…/…/…/topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.

0.001 Low

EPSS

Percentile

25.0%

Related for OSV:GHSA-5X3V-2GXR-59M2