A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.)
References
| Link | Resource |
|---|---|
| https://oxygenxml.com | Product |
| https://www.oxygenxml.com/security/advisory/SYNC-2023-042301.html | Mitigation Vendor Advisory |
| https://oxygenxml.com | Product |
| https://www.oxygenxml.com/security/advisory/SYNC-2023-042301.html | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://oxygenxml.com - Product | |
| References | () https://www.oxygenxml.com/security/advisory/SYNC-2023-042301.html - Mitigation, Vendor Advisory |
22 Apr 2023, 02:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.oxygenxml.com/security/advisory/SYNC-2023-042301.html - Mitigation, Vendor Advisory | |
| References | (MISC) https://oxygenxml.com - Product | |
| First Time |
Sync oxygen Content Fusion
Sync oxygen Xml Web Author Sync |
|
| CPE | cpe:2.3:a:sync:oxygen_xml_web_author:*:*:*:*:*:*:*:* cpe:2.3:a:sync:oxygen_content_fusion:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CWE | CWE-22 |
14 Apr 2023, 13:28
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-14 13:15
Updated : 2025-02-07 16:15
NVD link : CVE-2023-26559
Mitre link : CVE-2023-26559
CVE.ORG link : CVE-2023-26559
JSON object : View
Products Affected
sync
- oxygen_xml_web_author
- oxygen_content_fusion
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')