Description
In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
Remediation
References
http://www.securityfocus.com/bid/107844
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835
Related Vulnerabilities
CVE-2023-37954 Vulnerability in maven package com.sonyericsson.hudson.plugins.rebuild:rebuild
CVE-2018-17246 Vulnerability in npm package kibana
CVE-2018-1062 Vulnerability in maven package org.ovirt.engine.core:vdsbroker
CVE-2022-21704 Vulnerability in npm package log4js
CVE-2022-23223 Vulnerability in maven package org.apache.shenyu:shenyu-common