high8.3
CVE-2024-35219
OpenAPI Generator Online - Arbitrary File Read/Delete
Impact
### Impact Attackers can exploit the vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. ### Patches The issue was fixed via https://github.com/OpenAPITools/openapi-generator/pull/18652 (included in v7.6.0 release) by removing the usage of the `outputFolder` option. ### Workarounds No workaround available. ### References No other reference available.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.openapitools:openapi-generator-online | < 7.6.0 | 7.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
- https://github.com/OpenAPITools/openapi-generator/pull/18652
- https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
- https://github.com/advisories/GHSA-g3hr-p86p-593h
- https://nvd.nist.gov/vuln/detail/CVE-2024-35219