Description

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

Remediation

References

http://seclists.org/fulldisclosure/2016/Nov/13

https://github.com/perwendel/spark/issues/700

http://www.securityfocus.com/bid/94218

https://access.redhat.com/errata/RHSA-2017:0868

Related Vulnerabilities

CVE-2021-43821 Vulnerability in maven package org.opencastproject:opencast-ingest-service-impl

CVE-2022-25948 Vulnerability in npm package liquidjs

CVE-2023-49210 Vulnerability in npm package openssl

CVE-2021-21172 Vulnerability in npm package electron

CVE-2017-11342 Vulnerability in npm package node-sass

Severity

High

Classification

CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Mailing List Third Party Advisory Issue Tracking Patch VDB Entry