PT-2018-4892 · Dspace · Dspace

Khalil Shreateh · Published 2018-07-10 · Updated 2018-10-19 · CVE-2016-10726

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 3.6 DSpace versions 4.x prior to 4.5 DSpace versions 5.x prior to 5.5

Description The issue allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname. This can be demonstrated by a URI such as "themes/Reference/aa:etc/passwd".

Recommendations For DSpace versions prior to 3.6, update to version 3.6 or later. For DSpace versions 4.x prior to 4.5, update to version 4.5 or later. For DSpace versions 5.x prior to 5.5, update to version 5.5 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-10726

GHSA-4M9R-5GQP-7J82

Affected Products

Dspace

References · 8

• https://osv.dev/vulnerability/GHSA-4m9r-5gqp-7j82 · Vendor Advisory
• https://jira.duraspace.org/browse/DS-3094 · Vendor Advisory
• https://wiki.duraspace.org/display/DSDOC5x/Release+Notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10726 · Security Note
• https://github.com/DSpace/DSpace/releases/tag/dspace-5.5 · Note
• https://github.com/advisories/GHSA-4m9r-5gqp-7j82 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10726 · Note