CVE-2018-12542: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

October 17, 2018 (updated September 13, 2021)

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ‘' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.

References

bugs.eclipse.org/bugs/show_bug.cgi?id=539171
github.com/advisories/GHSA-h39x-m55c-v55h
github.com/vert-x3/vertx-web/issues/1025
lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2018-12542

Code Behaviors & Features

Detect and mitigate CVE-2018-12542 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →