CVE-2019-10242 Path traversal in Eclipse Kura

What is CVE-2019-10242?

CVE-2019-10242 is a medium-severity path traversal vulnerability in The Eclipse Foundation Eclipse Kura, published on 9 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.

Weakness: CWE-22

Which versions are affected by CVE-2019-10242?

It affects 1 product.

Products include Eclipse Kura.

How do I fix CVE-2019-10242?

No fix has been published for CVE-2019-10242 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-10242 being exploited?

There is no known exploitation of CVE-2019-10242 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse Kura

• CVE-2017-7649 Auth bypass in Eclipse Kura Installer Critical 9.8
• CVE-2026-9561 Security feature bypass in Eclipse Kura High 8.8
• CVE-2024-3046 Eclipse Kura LogServlet vulnerability High 7.5
• CVE-2019-10244 XML external entity in Eclipse Kura High 7.5
• CVE-2019-10243 Information disclosure in Eclipse Kura Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4mq9-66fv-8x9q.