CVE-2024-35219

Katalog CVE

CVSS 8.3 · High EPSS 3,6%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Skor CVSS 3.1 8.3 (High) menurut github.com.

Deskripsi (NVD)

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.

Rincian

Terbit di NVD

27 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.3 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

3,6% peluang dieksploitasi; lebih tinggi dari 89,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
• https://github.com/OpenAPITools/openapi-generator/pull/18652
• https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h