High severity vulnerability that affects org.dspace:dspace-xmlui
High severity
GitHub Reviewed
Published
Oct 19, 2018
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Package
Affected versions
>= 4.0, < 4.5
>= 5.0, < 5.5
< 3.6
Patched versions
4.5
5.5
3.6
Description
Published to the GitHub Advisory Database
Oct 19, 2018
Reviewed
Jun 16, 2020
Last updated
Jan 9, 2023
The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.
References