CVE-2019-11082: Path Traversal in DKPro Core
Summary
CVE-2019-11082: Path Traversal in DKPro Core. Affects de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl versions < 1.10.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DKPro Core is a package in the Maven ecosystem that provides a Dataset API for handling datasets. It is used for various natural language processing tasks and provides functionality for processing and analyzing textual data. The package 'de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl' is part of DKPro Core and is vulnerable to a path traversal vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2019-11082, allows an attacker to perform a directory traversal attack through the 'Explode.java' file in the Dataset API. By exploiting this vulnerability, an attacker can overwrite local files with the contents of an archive. This can lead to unauthorized access, data loss, or even remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected functionality or disable the functionality altogether if it is not essential for their use case. Additionally, it is advisable to implement proper input validation and sanitization techniques in any custom code that interacts with the vulnerable functionality.
Conclusion
The path traversal vulnerability in DKPro Core's Dataset API can lead to unauthorized access, data loss, or remote code execution. It is crucial to upgrade to the latest version (1.10.1 or later) to mitigate the risk. Implementing proper input validation and sanitization techniques in custom code is also recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl →
FAQ
DKPro Core is a package in the Maven ecosystem that provides a Dataset API for handling datasets in natural language processing tasks.
The vulnerability allows an attacker to perform directory traversal attacks, potentially leading to unauthorized access, data loss, or remote code execution.
To fix this vulnerability, it is recommended to upgrade DKPro Core to version 1.10.1 or later.
As a temporary workaround, users can restrict access to the affected functionality or disable it if not necessary.
Yes, the vulnerability can result in data loss if an attacker successfully exploits it to overwrite local files.
