PT-2018-4892 · Dspace · Dspace

Khalil Shreateh · Publicado 2018-07-10 · Atualizado 2018-10-19 · CVE-2016-10726

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 3.6 DSpace versions 4.x prior to 4.5 DSpace versions 5.x prior to 5.5

Description The issue allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname. This can be demonstrated by a URI such as "themes/Reference/aa:etc/passwd".

Recommendations For DSpace versions prior to 3.6, update to version 3.6 or later. For DSpace versions 4.x prior to 4.5, update to version 4.5 or later. For DSpace versions 5.x prior to 5.5, update to version 5.5 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2016-10726

GHSA-4M9R-5GQP-7J82

Produtos afetados

Dspace

Referências · 8

• https://github.com/DSpace/DSpace/releases/tag/dspace-5.5 · Nota
• https://osv.dev/vulnerability/GHSA-4m9r-5gqp-7j82 · Aviso do Fabricante
• https://jira.duraspace.org/browse/DS-3094 · Aviso do Fabricante
• https://wiki.duraspace.org/display/DSDOC5x/Release+Notes · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-10726 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10726 · Nota de Segurança
• https://github.com/advisories/GHSA-4m9r-5gqp-7j82 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10726 · Nota