MPXJ path Traversal vulnerability

보통 5.3CVE-2020-35460 · GHSA-p9j6-4pjr-gp48 · Published 14/12/2020 · updated 17/06/2026

요약

CVE-2020-35460은(는) net.sf.mpxj:mpxj, mpxj (mpxj), primavera unifier (oracle)에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.9%, 전체 취약점의 79.3%보다 높음.
조치: 8.3.5 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
net.sf.mpxj:mpxj Maven	`< 8.3.5`	`8.3.5`
mpxj mpxj	`< 8.3.5`	`8.3.5`
primavera unifier oracle	`= 16.1= 16.2= 18.8= 19.12= 21.12≥ 17.7, ≤ 17.12`	No fix yet

Description

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

NVD description

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

References

nvd.nist.gov/vuln/detail/CVE-2020-35460 · ADVISORY
joniles/mpxj commit 8eaf422 · WEB
oracle.com/security-alerts/cpujan2021.html · WEB
mpxj.org/changes-report.html · WEB

net.sf.mpxj:mpxj의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

net.sf.mpxj:mpxj

Maven

< 8.3.5

8.3.5

mpxj

< 8.3.5

8.3.5

primavera unifier

oracle

= 16.1= 16.2= 18.8= 19.12= 21.12≥ 17.7, ≤ 17.12

No fix yet

Description

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

NVD description

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

net.sf.mpxj:mpxj의 다른 취약점

모두 보기 →