CVE-2020-35460: Path Traversal
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-35460.
What is the severity of CVE-2020-35460?
The severity of CVE-2020-35460 is medium.
Which software versions are affected by CVE-2020-35460?
The affected software versions are Mpxj up to 8.3.5 and Oracle Primavera Unifier 17.7 to 17.12, 16.1, 16.2, 18.8, 19.12, and 21.12.
How does CVE-2020-35460 work?
CVE-2020-35460 allows directory traversal in the zip stream handler flow, which leads to the writing of files to arbitrary locations.
Are there any references related to CVE-2020-35460?
Yes, you can find more information about CVE-2020-35460 at the following references: [http://www.mpxj.org/changes-report.html#a8.3.5](http://www.mpxj.org/changes-report.html#a8.3.5), [https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d](https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d), [https://www.oracle.com/security-alerts/cpujan2021.html](https://www.oracle.com/security-alerts/cpujan2021.html).