CVE-2018-1306 Exposure of Sensitive Information in Apache Pluto
HighCVSS 7.5
EPSS 42.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.portals.pluto/pluto-container(Maven) | = 3.0.0 | No fix listed |
| org.apache.portals.pluto/pluto-container(Maven) | >= 3.0.0, < 3.0.1 | 3.0.1 |
| apache pluto | = 3.0.0 | No fix listed |
| Apache Pluto | = 3.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- 45396 exploit third-party-advisory vdb-entry
- portals.apache.org mitigation vendor-advisory
- github.com
- github.com product