Arbitrary File Access

2022-05-0404:57:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

59.2%

JSON

org.xwiki.commons:xwiki-commons-velocity is vulnerable to arbitrary file access. A privileged attacker who has access to an file returning API, is able to perform read or write operations on the filesystem because it is not properly sandboxed against using the Java File API.

CPENameOperatorVersion
xwiki commons - velocityle11.10.13
xwiki commons - velocityle7.4.6
xwiki commons - velocityle10.11.11
xwiki commons - velocityle12.6.6
xwiki commons - velocityle9.11.9
xwiki commons - velocityle12.10.2
xwiki commons - velocityle6.4.8
xwiki commons - velocityle8.4.6
xwiki commons - velocityle5.4.7
xwiki commons - velocityle11.10.13

Name	Operator	Version
xwiki commons - velocity	le	11.10.13
xwiki commons - velocity	le	7.4.6
xwiki commons - velocity	le	10.11.11
xwiki commons - velocity	le	12.6.6
xwiki commons - velocity	le	9.11.9
xwiki commons - velocity	le	12.10.2
xwiki commons - velocity	le	6.4.8
xwiki commons - velocity	le	8.4.6
xwiki commons - velocity	le	5.4.7
xwiki commons - velocity	le	11.10.13