Lucene search

GoogleOSV:GHSA-P9J6-4PJR-GP48

HistoryDec 18, 2020 - 6:28 p.m.

MPXJ path Traversal vulnerability

2020-12-1818:28:23

Google

osv.dev

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

39.1%

JSON

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

CPENameOperatorVersion
net.sf.mpxj:mpxjeq4.7.1
net.sf.mpxj:mpxjeq5.3.0
net.sf.mpxj:mpxjeq7.9.0
net.sf.mpxj:mpxjeq7.2.0
net.sf.mpxj:mpxjeq5.1.4
net.sf.mpxj:mpxjeq6.0.0
net.sf.mpxj:mpxjeq5.6.0
net.sf.mpxj:mpxjeq8.0.5
net.sf.mpxj:mpxjeq7.3.0
net.sf.mpxj:mpxjeq4.7.6

Name	Operator	Version
net.sf.mpxj:mpxj	eq	4.7.1
net.sf.mpxj:mpxj	eq	5.3.0
net.sf.mpxj:mpxj	eq	7.9.0
net.sf.mpxj:mpxj	eq	7.2.0
net.sf.mpxj:mpxj	eq	5.1.4
net.sf.mpxj:mpxj	eq	6.0.0
net.sf.mpxj:mpxj	eq	5.6.0
net.sf.mpxj:mpxj	eq	8.0.5
net.sf.mpxj:mpxj	eq	7.3.0
net.sf.mpxj:mpxj	eq	4.7.6

Rows per page:

1-10 of 1071

References

www.mpxj.org/changes-report.html#a8.3.5

github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d

nvd.nist.gov/vuln/detail/CVE-2020-35460

www.oracle.com/security-alerts/cpujan2021.html

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

39.1%

JSON

Related for OSV:GHSA-P9J6-4PJR-GP48