Path Traversal in Apache Jetspeed

2022-05-1703:56:49

Google

osv.dev

0.217 Low

EPSS

Percentile

96.5%

JSON

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a … (dot dot) in a ZIP archive entry, as demonstrated by “…/…/webapps/x.jsp.”

CPENameOperatorVersion
org.apache.portals.jetspeed-2:jetspeedeq2.2.2
org.apache.portals.jetspeed-2:jetspeedeq2.1.4
org.apache.portals.jetspeed-2:jetspeedeq2.2.0
org.apache.portals.jetspeed-2:jetspeedeq2.1.3
org.apache.portals.jetspeed-2:jetspeedeq2.3.0
org.apache.portals.jetspeed-2:jetspeedeq2.2.1
org.apache.portals.jetspeed-2:jetspeedeq2.0

Name	Operator	Version
org.apache.portals.jetspeed-2:jetspeed	eq	2.2.2
org.apache.portals.jetspeed-2:jetspeed	eq	2.1.4
org.apache.portals.jetspeed-2:jetspeed	eq	2.2.0
org.apache.portals.jetspeed-2:jetspeed	eq	2.1.3
org.apache.portals.jetspeed-2:jetspeed	eq	2.3.0
org.apache.portals.jetspeed-2:jetspeed	eq	2.2.1
org.apache.portals.jetspeed-2:jetspeed	eq	2.0