Description

com/mossle/cdn/CdnController.java in lemon 1.9.0 allows attackers to upload arbitrary files because the copyMultipartFileToFile method in CdnUtils only checks for a ../ substring, and does not validate the file type and spaceName parameter.

Remediation

References

https://github.com/xuhuisheng/lemon/issues/175

Related Vulnerabilities

CVE-2018-1002204 Vulnerability in maven package org.webjars.npm:adm-zip

CVE-2023-42399 Vulnerability in maven package org.webjars.npm:jodit

CVE-2020-11987 Vulnerability in maven package org.apache.xmlgraphics:batik-svgbrowser

CVE-2021-26814 Vulnerability in npm package wazuh

CVE-2023-23630 Vulnerability in npm package eta

Severity

High

Classification

CWE-434 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Third Party Advisory