Description

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.

Remediation

References

https://github.com/xuxueli/xxl-conf/issues/61

Related Vulnerabilities

CVE-2020-28168 Vulnerability in maven package org.webjars.bowergithub.axios:axios

CVE-2020-26291 Vulnerability in npm package urijs

CVE-2021-43306 Vulnerability in maven package org.webjars.bowergithub.jquery-validation:jquery-validation

CVE-2020-7699 Vulnerability in npm package express-fileupload

CVE-2020-28503 Vulnerability in maven package org.webjars.npm:copy-props

Severity

High

Classification

CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Issue Tracking Third Party Advisory