A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.)
References
Link | Resource |
---|---|
https://oxygenxml.com | Product |
https://www.oxygenxml.com/security/advisory/SYNC-2023-042301.html | Mitigation Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2023-04-14T00:00:00
Updated: 2023-04-14T00:00:00
Reserved: 2023-02-26T00:00:00
Link: CVE-2023-26559
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-04-14T13:15:07.890
Modified: 2023-04-22T02:05:06.593
Link: CVE-2023-26559
JSON object: View
Redhat Information
No data.
CWE