Lucene search

[email protected]CVE-2024-24569

HistoryFeb 01, 2024 - 7:15 p.m.

CVE-2024-24569

2024-02-0119:15:08

CWE-22

[email protected]

web.nvd.nist.gov

pixee

java

code

security

toolkit

api

vulnerability

zipsecurity

bypass

traversal

exploit

patch

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.1%

JSON

The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. ZipSecurity#isBelowCurrentDirectory is vulnerable to a partial-path traversal bypass. To be vulnerable to the bypass, the application must use toolkit version <=1.1.1, use ZipSecurity as a guard against path traversal, and have an exploit path. Although the control still protects attackers from escaping the application path into higher level directories (e.g., /etc/), it will allow “escaping” into sibling paths. For example, if your running path is /my/app/path you an attacker could navigate into /my/app/path-something-else. This vulnerability is patched in 1.1.2.

Affected configurations

Vulners

NVD

Node

pixeejava_code_security_toolkitRange<1.1.2

VendorProductVersionCPE
pixeejava_code_security_toolkit*cpe:2.3:a:pixee:java_code_security_toolkit:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pixee	java_code_security_toolkit	*	cpe:2.3:a:pixee:java_code_security_toolkit::::::::

CNA Affected

[
  {
    "vendor": "pixee",
    "product": "java-security-toolkit",
    "versions": [
      {
        "version": "< 1.1.2",
        "status": "affected"
      }
    ]
  }
]