high7.5
CVE-2018-20094
XXL-CONF Path Traversal vulnerability
Impact
An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via `../` in the keys parameter that can download any configuration file, related to `ConfController.java` and `PropUtil.java`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.xuxueli:xxl-conf-admin | <= 1.6.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xuxueli | Xxl-Conf | Version 1.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/xuxueli/xxl-conf/issues/61
- https://github.com/advisories/GHSA-8j39-fgfp-vxh8
- https://nvd.nist.gov/vuln/detail/CVE-2018-20094
- https://github.com/xuxueli/xxl-conf/blob/6726dfe7979ea6d8fb983771471cde69789de632/xxl-conf-admin/src/main/java/com/xxl/conf/admin/controller/ConfController.java