Description
An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.
Remediation
References
https://github.com/xuxueli/xxl-conf/issues/61
Related Vulnerabilities
CVE-2023-24998 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2021-23597 Vulnerability in npm package fastify-multipart
CVE-2023-27564 Vulnerability in npm package n8n
CVE-2020-7760 Vulnerability in npm package codemirror
CVE-2017-3202 Vulnerability in maven package com.exadel.flamingo.flex:amf-serializer