7.5

CVE-2018-1316

The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was addressed in Apache ODE 1.3.3 which was released in 2009, however the incorrect name CVE-2008-2370 was used on the advisory by mistake.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Ode Version > 1.1.1 <= 1.3.2
Apache ≫ Ode Version 1.0 Update incubating
Apache ≫ Ode Version 1.0 Update rc1-incubating
Apache ≫ Ode Version 1.0 Update rc2-incubating
Apache ≫ Ode Version 1.0 Update rc3-incubating
Apache ≫ Ode Version 1.0 Update rc4-incubating
Apache ≫ Ode Version 1.1 Update rc1
Apache ≫ Ode Version 1.1 Update rc2
Apache ≫ Ode Version 1.1 Update rc3
Apache ≫ Ode Version 1.1 Update rc4
Apache ≫ Ode Version 1.1 Update rc5
Apache ≫ Ode Version 1.1.1 Update rc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.14% 0.867
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 6.4 10 4.9
AV:N/AC:L/Au:N/C:N/I:P/A:P
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://mail-archives.apache.org/mod_mbox/www-announce/200908.mbox/%3Cfbdc6a970908072141w20a7a9d9ka1f896ad8073dffb%40mail.gmail.com%3E
Vendor Advisory
https://lists.apache.org/thread.html/ce416ddfba1a87f4b8e2d8125f1c3b45d1f0b350af29a4d0405e213b%40%3Cuser.ode.apache.org%3E