GHSA-xc4w-28g8-vqm5

Path Traversal in Gravitee API Management

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-25075

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.gravitee.apim:gravitee-api-management	< 1.25.3	1.25.3

Details

As written in the advisory (Markdown source, shown as plain text).

HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-25075 advisory
https://github.com/gravitee-io/gravitee-api-management package
https://medium.com/@maxime.escourbiac/write-up-of-path-traversal-on-gravitee-io-8835941be69f web