Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-k8ud-cu6f-vbff

Summary

Path Traversal
Jenkins and Jenkins LTS does not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allows users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded.

Aliases

alias	CVE-2018-6356

Fixed_packages

url	pkg:maven/org.jenkins-ci.main/jenkins-core@2.107
purl	pkg:maven/org.jenkins-ci.main/jenkins-core@2.107
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.107

Affected_packages

url pkg:maven/org.jenkins-ci.main/jenkins-core@2.89.4

purl pkg:maven/org.jenkins-ci.main/jenkins-core@2.89.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-k8ud-cu6f-vbff

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.main/jenkins-core@2.89.4

References

reference_url	https://jenkins.io/security/advisory/2018-02-14/
reference_id
reference_type
scores
url	https://jenkins.io/security/advisory/2018-02-14/

reference_url	http://www.securityfocus.com/bid/103037
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/103037

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2018-6356
reference_id	CVE-2018-6356
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2018-6356

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	22
name	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k8ud-cu6f-vbff

Vulnerability Instance