CVE-2020-35460 MPXJ path Traversal vulnerability
Attackers can write files to arbitrary locations via directory traversal in the zip stream handler of the MPXJ library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35460?
CVE-2020-35460 is a medium-severity path traversal vulnerability in Oracle Primavera Unifier, published on 14 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.
Weakness: CWE-22
Which versions are affected by CVE-2020-35460?
2 open source packages ship an affected version, including net.sf.mpxj:mpxj. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
net.sf.mpxj:mpxj Maven | All versions | 8.3.5 |
net.sf.mpxj:mpxj Maven | All versions | 8.3.5 |
Products include Mpxj Mpxj, Oracle Primavera Unifier.
How do I fix CVE-2020-35460?
Upgrade net.sf.mpxj:mpxj to 8.3.5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-35460 being exploited?
There is no known exploitation of CVE-2020-35460 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Primavera Unifier
Sources
Also known as GHSA-p9j6-4pjr-gp48.