Description
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.opencms:opencms-core | < 6.2.2 | 6.2.2 | GHSA-64hc-4jx3-62jp |
References
- 21193 third-party-advisory
- http://www.opencms.org/opencms/en/shownews.html?id=1002
- 1302 third-party-advisory
- 20060726 Multiple vulnerabilities in OpenCMS mailing-list
- opencms-downloadtrigger-file-access(28000) vdb-entry
- http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt
- http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip