| Package | Affected versions | Patched versions |
|---|---|---|
| oxygen content fusion | < 5.0.3 | 5.0.3 |
| oxygen xml web author | ≥ 24.0.0.0, < 24.1.0.3≥ 25.0.0.0, < 25.1.0.3< 23.1.1.4 | 24.1.0.325.1.0.323.1.1.4 |
A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free