Description
An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.
Remediation
References
https://github.com/xuxueli/xxl-conf/issues/61
Related Vulnerabilities
CVE-2020-35209 Vulnerability in maven package io.atomix:atomix
CVE-2023-27162 Vulnerability in maven package org.openapitools:openapi-generator-project
CVE-2020-19697 Vulnerability in maven package org.webjars.npm:editor.md
CVE-2022-0436 Vulnerability in npm package grunt
CVE-2022-47551 Vulnerability in maven package io.apiman:apiman-manager-api-beans