CVE-2018-13864 Play Framework's Assets controller vulnerable to directory traversal
HighCVSS 7.5
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.typesafe.play/play_2.12(Maven) | >= 2.6.12, < 2.6.16 | 2.6.16 |
| com.typesafe.play/play_2.12(Maven) | = 2.6.12 | No fix listed |
| com.typesafe.play/play_2.12(Maven) | = 2.6.13 | No fix listed |
| com.typesafe.play/play_2.12(Maven) | = 2.6.14 | No fix listed |
| com.typesafe.play/play_2.12(Maven) | = 2.6.15 | No fix listed |
| lightbend play framework | >= 2.6.12, <= 2.6.15 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- www.playframework.com vendor-advisory
- discuss.lightbend.com
- github.com