GHSA-64hc-4jx3-62jp

Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter

Source: GitHub Advisory Database (reviewed) Moderate CVE-2006-3934

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.opencms:opencms-core	< 6.2.2	6.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2006-3934 advisory
https://github.com/alkacon/opencms-core/commit/8f1c04c5a16fe8d0bdbd13b65bf2a7b5cf100ff9 web
https://exchange.xforce.ibmcloud.com/vulnerabilities/28000 web
https://github.com/alkacon/opencms-core package
http://securityreason.com/securityalert/1302 web
http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip web
http://www.opencms.org/opencms/en/shownews.html?id=1002 web