PT-2018-15295 · Eclipse · Rdf4J

Bart Hanssens · Published 2018-12-19 · Updated 2024-08-16 · CVE-2018-20227

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RDF4J versions 2.4.2 through 2.4.2 RDF4J versions prior to 2.5.0

Description The issue allows Directory Traversal via ../ in an entry in a ZIP archive.

Recommendations For RDF4J version 2.4.2, update to version 2.5.0 or later. For RDF4J versions prior to 2.5.0, update to version 2.5.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-20227

GHSA-X3CR-X949-H5JV

Affected Products

Rdf4J

References · 8

• 🔥 https://github.com/eclipse/rdf4j/issues/1210 · Exploit
• https://github.com/eclipse/rdf4j/pull/1211/commits/df15a4d7a8f2789c043b27c9eafe1b30316cfa79 · Patch
• https://osv.dev/vulnerability/GHSA-x3cr-x949-h5jv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20227 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20227 · Vendor Advisory
• https://github.com/eclipse-rdf4j/rdf4j · Note
• https://github.com/eclipse-rdf4j/rdf4j/commit/df15a4d7a8f2789c043b27c9eafe1b30316cfa79 · Note
• https://t.me/cvenotify/90941 · Telegram Post