7.5

CVE-2018-1316

The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was addressed in Apache ODE 1.3.3 which was released in 2009, however the incorrect name CVE-2008-2370 was used on the advisory by mistake.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Ode Version > 1.1.1 <= 1.3.2
Apache ≫ Ode Version1.0 Updateincubating
Apache ≫ Ode Version1.0 Updaterc1-incubating
Apache ≫ Ode Version1.0 Updaterc2-incubating
Apache ≫ Ode Version1.0 Updaterc3-incubating
Apache ≫ Ode Version1.0 Updaterc4-incubating
Apache ≫ Ode Version1.1 Updaterc1
Apache ≫ Ode Version1.1 Updaterc2
Apache ≫ Ode Version1.1 Updaterc3
Apache ≫ Ode Version1.1 Updaterc4
Apache ≫ Ode Version1.1 Updaterc5
Apache ≫ Ode Version1.1.1 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.97% 0.818
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:N/I:P/A:P
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.