CVE-2023-40828

Katalog CVE

CVSS 7.5 · High EPSS 1,5%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada pf4j project pf4j. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.

Rincian

Terbit di NVD

28 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pf4j/pf4j/pull/537 patch · advisory vendor
• https://github.com/pf4j/pf4j/pull/538 patch · advisory vendor
• https://github.com/pf4j/pf4j/commit/8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72 patch