High severity vulnerability that affects org.dspace:dspace-xmlui

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

Vulnerability ID: GHSA-4m9r-5gqp-7j82
Aliases: CVE-2016-10726
Published: 2018-10-19 16:52:06
CWE: CWE-22
Severity rating: HIGH
CVSS: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven
name: org.dspace:dspace-xmlui
package: ecosystem: Maven
name: org.dspace:dspace-xmlui
package: ecosystem: Maven
name: org.dspace:dspace-xmlui