Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal

높음 7.5CVE-2018-17297 · GHSA-rhq2-2574-78mc · Published 21/09/2018 · updated 17/06/2026

요약

CVE-2018-17297은(는) cn.hutool:hutool-all, cn.hutool:hutool-core, cn.hutool:hutool-parent에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.7%, 전체 취약점의 85.8%보다 높음.
조치: 4.1.12 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
cn.hutool:hutool-all Maven	`< 4.1.12`	`4.1.12`
cn.hutool:hutool-core Maven	`< 4.1.12`	`4.1.12`
cn.hutool:hutool-parent Maven	`< 4.1.12`	`4.1.12`
hutool hutool	`< 4.1.12`	`4.1.12`

Description

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.

NVD description

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.

References

nvd.nist.gov/vuln/detail/CVE-2018-17297 · ADVISORY
looly/hutool · WEB
GitHub Advisory GHSA-rhq2-2574-78mc · ADVISORY
looly/hutool · PACKAGE

cn.hutool:hutool-all의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cn.hutool:hutool-all

Maven

< 4.1.12

4.1.12

cn.hutool:hutool-core

Maven

< 4.1.12

4.1.12

cn.hutool:hutool-parent

Maven

< 4.1.12

4.1.12

hutool

< 4.1.12

4.1.12

Description

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.

NVD description

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.

cn.hutool:hutool-all의 다른 취약점

모두 보기 →