CVE-2024-49771: MPXJ Path Traversal Vulnerability
Summary
CVE-2024-49771: MPXJ has a Potential Path Traversal Vulnerability. Affects net.sf.mpxj:mpxj versions >= 8.3.5, < 13.5.1. Fixed in 13.5.1. How to fix ↓
Also tracked for
- mpxj · PyPI
The same CVE-2024-49771 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MPXJ is an open-source library designed for reading and writing project management file formats, such as Microsoft Project and Primavera. It is widely used in various applications to facilitate project data manipulation. However, MPXJ has been found to have a potential path traversal vulnerability, which could allow unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from an incomplete patch for CVE-2020-35460, which allows a malicious actor to construct a path that may bypass the original fix. This could lead to files being written to arbitrary locations on the server, posing a risk of data exposure or corruption. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
How To Fix
Minimum fixed version
13.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing zip files to MPXJ until the package is updated to a secure version.
Conclusion
The MPXJ library has a potential path traversal vulnerability that could allow unauthorized file access. It is crucial to update to version 13.5.1 or later to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for net.sf.mpxj:mpxj →
FAQ
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow unauthorized access to sensitive files on the server, leading to data breaches or corruption.
Yes, version 13.5.1 and later of MPXJ addresses this vulnerability and is safe to use.
If you cannot update the package right away, refrain from using zip files with MPXJ as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.sf.mpxj:mpxj.
