CVE-2019-0225: Path Traversal Vulnerability in org.apache.jspwiki:jspwiki-war
Summary
CVE-2019-0225: Improper Limitation of a Pathname ('Path Traversal') in org.apache.jspwiki:jspwiki-war. Affects org.apache.jspwiki:jspwiki-war versions >= 2.9.0, < 2.11.0.M3. Fixed in 2.11.0.M3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.apache.jspwiki:jspwiki-war package is a component of Apache JSPWiki, a Java-based wiki engine. It provides functionality for creating and managing wikis. The package is commonly used in web applications to enable wiki-like features such as content creation, editing, and collaboration. However, versions 2.9.0 to 2.11.0.M2 of this package are vulnerable to a path traversal attack.
Vulnerability Detail
The vulnerability, identified as CVE-2019-0225, is an improper limitation of a pathname (path traversal) issue. It allows an attacker to access files under the ROOT directory of the application. By exploiting this vulnerability, an attacker can obtain registered users' details, potentially leading to unauthorized access or disclosure of sensitive information.
How To Fix
Minimum fixed version
2.11.0.M3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization mechanisms in the application. This can help prevent malicious input from being processed and limit the impact of the vulnerability. Here is an example of input validation using Java code:
String sanitizedPath = userInput.replaceAll("[\\/:*?\"<>|]", "");
Conclusion
The path traversal vulnerability in the org.apache.jspwiki:jspwiki-war package allows attackers to access files outside the intended directory, potentially compromising the security of the application. It is crucial to upgrade to the latest version or implement appropriate input validation mechanisms to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-war →
FAQ
The vulnerability allows an attacker to access files under the ROOT directory of the application, potentially leading to unauthorized access or disclosure of sensitive information.
Versions 2.9.0 to 2.11.0.M2 of the org.apache.jspwiki:jspwiki-war package are affected.
Yes, upgrading to version 2.11.0.M3 or later of the org.apache.jspwiki:jspwiki-war package fixes this vulnerability.
Implementing input validation and sanitization mechanisms in the application can help mitigate the risk until the package is upgraded.
You can find more information about this vulnerability in the CVE-2019-0225 advisory and the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-war.
