CVE-2024-49771CWE-22

MPXJ has a Potential Path Traversal Vulnerability

Medium · published October 28, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-10-28T16:57Z
EPSS history
Timeline
  • 28 OCT 16:57Z
    MPXJ has a Potential Path Traversal Vulnerability
    cvelistv5