CVE-2018-20094: Path Traversal

Q: What is the severity of CVE-2018-20094?

The severity of CVE-2018-20094 is high with a CVSS score of 7.5.

Q: How does CVE-2018-20094 impact XXL-CONF 1.6.0?

CVE-2018-20094 allows for a path traversal vulnerability in XXL-CONF 1.6.0, which can download any configuration file.

Q: How can I fix the CVE-2018-20094 vulnerability in XXL-CONF 1.6.0?

To fix the CVE-2018-20094 vulnerability, upgrade to a version of XXL-CONF that is not affected by this issue.

Q: Are there any references for CVE-2018-20094?

Yes, you can find references for CVE-2018-20094 at the following links: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-20094), [GitHub Issue](https://github.com/xuxueli/xxl-conf/issues/61), [GitHub Code](https://github.com/xuxueli/xxl-conf/blob/6726dfe7979ea6d8fb983771471cde69789de632/xxl-conf-admin/src/main/java/com/xxl/conf/admin/controller/ConfController.java).

Q: What is the CWE classification for CVE-2018-20094?

CVE-2018-20094 is classified as CWE-22, which refers to Path Traversal vulnerabilities.

Published Dec 12, 2018

Updated

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.

Other sources

Affected Software

2 affected components

maven/com.xuxueli:xxl-conf-admin<=1.6.0

Xuxueli Xxl-conf=1.6.0

Event History

Dec 12, 2018

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Dec 19, 2018

Advisory Published

07:25 PM

Frequently Asked Questions

What is the severity of CVE-2018-20094?

The severity of CVE-2018-20094 is high with a CVSS score of 7.5.

How does CVE-2018-20094 impact XXL-CONF 1.6.0?