Description

com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.

Remediation

References

https://github.com/xuhuisheng/lemon/issues/175

Related Vulnerabilities

CVE-2020-15138 Vulnerability in npm package prismjs

CVE-2020-7788 Vulnerability in npm package ini

CVE-2020-26296 Vulnerability in npm package vega

CVE-2021-23452 Vulnerability in npm package x-assign

CVE-2022-44729 Vulnerability in maven package org.apache.xmlgraphics:batik-svgrasterizer

Severity

High

Classification

CWE-434 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Third Party Advisory