CVE-2020-35460: MPXJ path Traversal vulnerability in net.sf.mpxj:mpxj
Summary
CVE-2020-35460: MPXJ path Traversal vulnerability. Affects net.sf.mpxj:mpxj versions < 8.3.5. Fixed in 8.3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net.sf.mpxj:mpxj package is a Maven ecosystem library used for reading and writing project management file formats. It provides functionality to handle various file formats and is commonly used in project management applications. However, a vulnerability has been discovered in versions prior to 8.3.5 that allows directory traversal in the zip stream handler flow, enabling the writing of files to arbitrary locations.
Vulnerability Detail
The MPXJ path Traversal vulnerability in net.sf.mpxj:mpxj allows an attacker to exploit the zip stream handler flow and write files to unintended locations. By manipulating the zip stream, an attacker can traverse directories and write files to arbitrary locations on the system. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which the vulnerable library is used.
How To Fix
Minimum fixed version
8.3.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of the net.sf.mpxj:mpxj package.
Conclusion
The MPXJ path Traversal vulnerability in net.sf.mpxj:mpxj exposes applications to the risk of unauthorized file writing. To mitigate this vulnerability, it is crucial to upgrade to version 8.3.5 or later of the net.sf.mpxj:mpxj package. Additionally, it is recommended to regularly monitor for vulnerabilities using tools like Vulert to ensure the security of your application.
See every vulnerability recorded for net.sf.mpxj:mpxj →
FAQ
This vulnerability allows an attacker to write files to arbitrary locations, potentially leading to unauthorized access, data leakage, or remote code execution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
There are no known public exploits for this vulnerability at the moment. However, it is important to patch your application to prevent any potential attacks.
No, the recommended mitigation is to upgrade the net.sf.mpxj:mpxj package to the fixed version. This ensures that the vulnerability is properly addressed.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for net.sf.mpxj:mpxj.
