Description
In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
Remediation
References
http://www.securityfocus.com/bid/107844
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835
Related Vulnerabilities
CVE-2020-10969 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-26282 Vulnerability in maven package com.browserup:browserup-proxy-rest
CVE-2018-16330 Vulnerability in npm package editor.md
CVE-2021-27292 Vulnerability in npm package ua-parser-js
CVE-2020-7684 Vulnerability in npm package rollup-plugin-serve