In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
oryginał ENCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NEclipse Kura
APPEclipse≤ 4.0.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
Powiązane podatności
CVE-2017-7649CRITICAL9.8PL ✓ten sam produkt
Eclipse Kura: pominięcie uwierzytelnienia przez otwarty port Equinox (IPv6)
CVE-2026-9561HIGH8.8ten sam produkt
Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritativ...
CVE-2024-3046HIGH7.5ten sam produkt
In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to th...
CVE-2019-10244HIGH7.5ten sam produkt
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt compo...
CVE-2019-10243MEDIUM5.3ten sam produkt
In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This c...