Description
In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
Remediation
References
http://www.securityfocus.com/bid/107844
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835
Related Vulnerabilities
CVE-2022-24891 Vulnerability in maven package org.owasp.esapi:esapi
CVE-2020-7763 Vulnerability in npm package phantom-html-to-pdf
CVE-2021-43466 Vulnerability in maven package org.thymeleaf:thymeleaf-spring5
CVE-2020-15232 Vulnerability in maven package org.mapfish.print:print-lib
CVE-2019-10298 Vulnerability in maven package org.jenkins-ci.plugins:koji