CVE-2020-35460

Katalog CVE

CVSS 5.3 · Medium EPSS 1,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada mpxj, oracle primavera unifier. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

Rincian

Terbit di NVD

14 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.mpxj.org/changes-report.html#a8.3.5 release notes · advisory vendor
• https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2021.html patch · advisory pihak ketiga