CVE-2019-17538

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge (aka jnoj) version 0.8.0

Description The issue allows for Directory Traversal, enabling file reading via a specific substring in the "web/polygon/problem/viewfile" endpoint, such as "id=1&name=../".

Recommendations For version 0.8.0, as a temporary workaround, consider restricting access to the "web/polygon/problem/viewfile" endpoint until a patch is available. Avoid using the name parameter with relative paths (e.g., "../") in the affected endpoint to minimize the risk of exploitation.