Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server
Vulnerability Description
CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Vulnerability Type
输入验证不恰当
Vulnerability Title
CycloneDX BOM Repository Server 路径遍历漏洞
Vulnerability Description
CycloneDX BOM Repository Server是一个 BOM 存储库服务器。用于分发 CycloneDX BOM。 CycloneDX BOM Repository Server 2.0.1之前版本存在路径遍历漏洞，该漏洞源于不正确的输入验证导致路径遍历问题。攻击者利用该漏洞可以创建任意目录或删除任意目录导致拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A