PT-2022-24351 · Onedev · Onedev
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Onedev version 7.4.14
Description
The issue allows attackers to access restricted files and directories by uploading a crafted JAR file into the "/opt/onedev/lib" directory, which is a path traversal vulnerability.
Recommendations
For Onedev version 7.4.14, consider restricting access to the "/opt/onedev/lib" directory to prevent uploading of crafted JAR files until a patch is available.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Onedev