CVE-2017-20284 Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet
Remote unauthenticated attackers can read arbitrary files on the server via path traversal in the Resin documentation webapp.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-20284?
CVE-2017-20284 is a high-severity path traversal vulnerability in Caucho Technology, Inc. Resin, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests with directory traversal sequences to the servlet endpoint to read files outside the intended tutorial directory on the underlying system. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-12-10.
Weakness: CWE-22
Which versions are affected by CVE-2017-20284?
How do I fix CVE-2017-20284?
No fix has been published for CVE-2017-20284 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-20284 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-20284 exists.
Sources
Also known as GHSA-x46g-q89h-7xg3.