Description
In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
Remediation
References
http://www.securityfocus.com/bid/107844
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835
Related Vulnerabilities
CVE-2020-27543 Vulnerability in npm package restify-paginate
CVE-2017-3160 Vulnerability in npm package cordova-android
CVE-2019-1003054 Vulnerability in maven package info.bluefloyd.jenkins:jenkins-jira-issue-updater
CVE-2017-5664 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2022-48285 Vulnerability in maven package org.webjars.bowergithub.stuk:jszip