Description
In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
Remediation
References
http://www.securityfocus.com/bid/107844
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835
Related Vulnerabilities
CVE-2020-28472 Vulnerability in maven package org.webjars.bower:aws-sdk
CVE-2020-5497 Vulnerability in maven package org.mitre:openid-connect-common
CVE-2021-39231 Vulnerability in maven package org.apache.ozone:ozone-main
CVE-2022-24278 Vulnerability in npm package convert-svg-core
CVE-2020-2166 Vulnerability in maven package de.taimos:pipeline-aws