CVE-2020-7647 path traversal in Jooby
Attackers can exploit directory traversal vectors in the Jooby web framework to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7647?
CVE-2020-7647 is a medium-severity path traversal vulnerability in io.jooby:jooby and org.jooby:jooby, published on 11 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.
Weakness: CWE-22
Which versions are affected by CVE-2020-7647?
4 open source packages ship an affected version, including io.jooby:jooby and org.jooby:jooby. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.jooby:jooby Maven | All versions | 2.8.2 |
io.jooby:jooby Maven | All versions | 2.8.2 |
org.jooby:jooby Maven | All versions | 2.8.2 |
org.jooby:jooby Maven | All versions | 2.8.2 |
Products include Jooby Jooby.
How do I fix CVE-2020-7647?
Upgrade io.jooby:jooby to 2.8.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-7647 being exploited?
There is no known exploitation of CVE-2020-7647 in the wild and no public exploit code.
Other vulnerabilities in io.jooby:jooby and org.jooby:jooby
Sources
Also known as GHSA-px9h-x66r-8mpc.