Description
In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
Remediation
References
http://www.securityfocus.com/bid/107844
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835
Related Vulnerabilities
CVE-2018-11788 Vulnerability in maven package org.apache.karaf.specs:org.apache.karaf.specs.java.xml
CVE-2022-32287 Vulnerability in maven package org.apache.uima:uimaj-core
CVE-2022-24613 Vulnerability in maven package com.drewnoakes:metadata-extractor
CVE-2021-39135 Vulnerability in npm package @npmcli/arborist
CVE-2022-25867 Vulnerability in maven package io.socket:socket.io-client