CVE-2019-17640: Path Traversal
In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17640?
CVE-2019-17640 has a medium severity rating due to its potential to allow directory traversal on Windows systems.
How do I fix CVE-2019-17640?
To mitigate CVE-2019-17640, upgrade to the latest version of Eclipse Vert.x that addresses this vulnerability.
Which versions of Eclipse Vert.x are affected by CVE-2019-17640?
Eclipse Vert.x versions 3.4.0 to 3.9.4 and various 4.0.0 milestones and betas are affected by CVE-2019-17640.
What impact does CVE-2019-17640 have on vulnerable systems?
CVE-2019-17640 allows attackers to escape the webroot folder, potentially exposing sensitive files on affected Windows systems.
Is there a workaround for CVE-2019-17640?
A workaround for CVE-2019-17640 involves applying restrictions on the StaticHandler configuration to prevent directory traversal.