CVSS 4.8 · Medium EPSS 10,5%
Kerentanan Improper Input Validation pada apache commons io, debian linux +27 lainnya. Skor CVSS 3.1 4.8 (Medium) menurut NVD.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| apache | commons io | Versi 2.2 |
| apache | commons io | Versi 2.3 |
| apache | commons io | Versi 2.4 |
| apache | commons io | Versi 2.5 |
| apache | commons io | Versi 2.6 |
| debian | debian linux | Versi 9.0 |
| oracle | access manager | Versi 11.1.2.3.0 |
| oracle | access manager | Versi 12.2.1.3.0 |
| oracle | access manager | Versi 12.2.1.4.0 |
| oracle | agile engineering data management | Versi 6.2.1.0 |
| oracle | agile product lifecycle management | Versi 9.3.6 |
| oracle | application performance management | Versi 13.4.1.0 |
| oracle | application performance management | Versi 13.5.1.0 |
| oracle | application testing suite | Versi 13.3.0.1 |
| oracle | banking apis | Versi 18.1 |
| oracle | banking apis | Versi 18.2 |
| oracle | banking apis | Versi 18.3 |
| oracle | banking apis | Versi 19.1 |
| oracle | banking apis | Versi 19.2 |
| oracle | banking apis | Versi 20.1 |
| oracle | banking apis | Versi 21.1 |
| oracle | banking digital experience | Versi 17.2 |
| oracle | banking digital experience | Versi 18.1 |
| oracle | banking digital experience | Versi 18.3 |
| oracle | banking digital experience | Versi 19.1 |
| oracle | banking digital experience | Versi 19.2 |
| oracle | banking digital experience | Versi 20.1 |
| oracle | banking digital experience | Versi 21.1 |
| oracle | banking enterprise default management | Versi 2.6.2 |
| oracle | banking enterprise default management | Versi 2.7.0 |
| oracle | banking enterprise default management | Versi 2.7.1 |
| oracle | banking enterprise default management | Versi 2.10.0 |
| oracle | banking enterprise default management | Versi 2.12.0 |
| oracle | banking enterprise default managment | Versi 2.3.0 hingga 2.4.0 |
| oracle | banking party management | Versi 2.7.0 |
| oracle | banking platform | Versi 2.3.0 hingga 2.4.1 |
| oracle | banking platform | Versi 2.6.2 |
| oracle | banking platform | Versi 2.7.0 |
| oracle | banking platform | Versi 2.7.1 |
| oracle | blockchain platform | Semua versi sebelum 21.1.2 |
| oracle | commerce guided search | Versi 11.3.2 |
| oracle | communications application session controller | Versi 3.9.0 |
| oracle | communications billing and revenue management elastic charging engine | Versi 11.3 |
| oracle | communications billing and revenue management elastic charging engine | Versi 12.0 |
| oracle | communications cloud native core network repository function | Versi 1.14.0 |
| oracle | communications cloud native core policy | Versi 1.14.0 |
| oracle | communications cloud native core unified data repository | Versi 1.4.0 |
| oracle | communications contacts server | Versi 8.0.0.6.0 |
| oracle | communications converged application server - service controller | Versi 6.2 |
| oracle | communications convergence | Versi 3.0.2.2.0 |
| oracle | communications design studio | Versi 7.4.0 hingga 7.4.2 |
| oracle | communications design studio | Versi 7.3.5 |
| oracle | communications diameter intelligence hub | Versi 8.0.0 hingga 8.1.0 |
| oracle | communications diameter intelligence hub | Versi 8.2.0 hingga 8.2.3 |
| oracle | communications interactive session recorder | Versi 6.3 |
| oracle | communications interactive session recorder | Versi 6.4 |
| oracle | communications offline mediation controller | Versi 12.0.0.3 |
| oracle | communications order and service management | Versi 7.3 |
| oracle | communications order and service management | Versi 7.4 |
| oracle | communications policy management | Versi 12.5.0.0.0 |