CVE-2018-1263: Path Traversal
First published: Wed May 09 2018(Updated: )
Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Credit: security_alert@emc.com security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.springframework.integration:spring-integration-zip | <1.0.2 | 1.0.2 |
| VMware Spring Integration | <1.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/104179
- https://pivotal.io/security/cve-2018-1263
- https://nvd.nist.gov/vuln/detail/CVE-2018-1263
- https://github.com/spring-projects/spring-integration-extensions/commit/d10f537283d90eabd28af57ac97f860a3913bf9b
- https://web.archive.org/web/20210125210559/https://www.securityfocus.com/bid/104179
- https://github.com/advisories/GHSA-87vg-5pgx-pggh (Advisory)
Frequently Asked Questions
What is the severity of CVE-2018-1263?
CVE-2018-1263 is considered a moderate severity vulnerability due to its potential for arbitrary file write exploitation.
How do I fix CVE-2018-1263?
To fix CVE-2018-1263, upgrade to spring-integration-zip version 1.0.2 or higher.
Which software is affected by CVE-2018-1263?
CVE-2018-1263 affects spring-integration-zip versions prior to 1.0.2.
What type of vulnerability is CVE-2018-1263?
CVE-2018-1263 is classified as an arbitrary file write vulnerability.
What attack vector is associated with CVE-2018-1263?
CVE-2018-1263 can be exploited through a specially crafted zip archive that may include path traversal sequences.
- agent/type
- agent/author
- agent/softwarecombine
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-87vg-5pgx-pggh
- alias/CVE-2018-1263
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/description
- collector/github-advisory
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/maven
- vendor/vmware
- canonical/vmware spring integration