Not rated
CVE-2018-12542 In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that…
Description
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Vert.x 3.5 | earliest → 3.5.3 | No fix stated |
| Eclipse Vert.x 3.0 | 3.0 → latest | No fix stated |
Other CVEs of Eclipse Vert.x
The 6 CVEs of Eclipse Vert.x →
CVE-2019-17640
In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4,…
Not rated
CVE-2018-12541
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http…
Not rated
CVE-2018-12544
In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without…
Not rated
CVE-2018-12537
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter…
Not rated