CVE-2016-10726 High severity vulnerability that affects org.dspace:dspace-xmlui
HighCVSS 7.5
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.dspace/dspace-xmlui(Maven) | >= 4.0, < 4.5 | 4.5 |
| org.dspace/dspace-xmlui(Maven) | >= 5.0, < 5.5 | 5.5 |
| org.dspace/dspace-xmlui(Maven) | < 3.6 | 3.6 |
| org.dspace/dspace-xmlui(Maven) | = 4.0 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 4.1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 4.2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 4.3 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 4.4 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 5.0 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 5.1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 5.2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 5.3 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 5.4 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5-alpha | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.0 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.0-beta1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.0-beta2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.0-rc1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.1-beta | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.2-rc1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.5.2-rc2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.6.0 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.6.0-rc1 | No fix listed |
Show 28 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.dspace/dspace-xmlui(Maven) | = 1.6.0-rc2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.6.1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.6.2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.7.0 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.7.0-rc1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.7.0-rc2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.7.1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.7.2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.7.3 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.8.0 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.8.0-rc1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.8.0-rc2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.8.0-rc3 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.8.1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.8.2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 1.8.3 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.0 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.0-rc1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.0-rc2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.0-rc3 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.1 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.2 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.3 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.4 | No fix listed |
| org.dspace/dspace-xmlui(Maven) | = 3.5 | No fix listed |
| duraspace dspace | < 3.6 | 3.6 |
| duraspace dspace | >= 4.0, < 4.5 | 4.5 |
| duraspace dspace | >= 5.0, < 5.5 | 5.5 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com third-party-advisory
- github.com vendor-advisory
- jira.duraspace.org patch vendor-advisory
- wiki.duraspace.org vendor-advisory