title: Directory traversal
description: A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
affected:
{
product: codehaus-plexus
vendor: n/a
versions:
version: 3.0.24, status: unaffected
}
{
vendor: Red Hat
product: Red Hat Integration Camel K
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: codehaus-plexus
cpe: cpe:/a:redhat:camel_k:1
}
{
vendor: Red Hat
product: A-MQ Clients 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: unaffected
cpes: cpe:/a:redhat:a_mq_clients:2
}
{
vendor: Red Hat
product: Red Hat A-MQ Online
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:amq_online:1
}
{
vendor: Red Hat
product: Red Hat build of Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:quarkus:2
}
{
vendor: Red Hat
product: Red Hat Data Grid 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:jboss_data_grid:8
}
{
vendor: Red Hat
product: Red Hat Decision Manager 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_brms_platform:7
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: plexus-utils
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: maven:3.6/plexus-utils
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: maven:3.8/plexus-utils
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: maven:3.8/plexus-utils
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: plexus-utils
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
vendor: Red Hat
product: Red Hat Integration Camel for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:camel_spring_boot:3
}
{
vendor: Red Hat
product: Red Hat Integration Camel Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:camel_quarkus:2
}
{
vendor: Red Hat
product: Red Hat Integration Change Data Capture
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:integration:1
}
{
vendor: Red Hat
product: Red Hat Integration Service Registry
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:service_registry:2
}
{
vendor: Red Hat
product: Red Hat JBoss A-MQ 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: unaffected
cpes: cpe:/a:redhat:amq_broker:7
}
{
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_data_grid:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:jbosseapxp
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_fuse:6
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:jboss_fuse:7
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse Service Works 6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_fuse_service_works:6
}
{
vendor: Red Hat
product: Red Hat JBoss Web Server 3
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_web_server:3
}
{
vendor: Red Hat
product: Red Hat JBoss Web Server 5
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: codehaus-plexus
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_enterprise_web_server:5
}
{
vendor: Red Hat
product: Red Hat OpenShift Application Runtimes
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: unaffected
cpes: cpe:/a:redhat:openshift_application_runtimes:1.0
}
{
vendor: Red Hat
product: Red Hat Process Automation 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: org.codehaus.plexus-plexus-utils
defaultStatus: affected
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-byte-buddy
defaultStatus: affected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven
defaultStatus: unaffected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-archiver
defaultStatus: unaffected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-assembly-plugin
defaultStatus: affected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-compiler-plugin
defaultStatus: affected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-jar-plugin
defaultStatus: unaffected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-plugin-bundle
defaultStatus: affected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-remote-resources-plugin
defaultStatus: unaffected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-shade-plugin
defaultStatus: affected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-source-plugin
defaultStatus: affected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-maven-surefire
defaultStatus: affected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat Software Collections
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-maven36-plexus-utils
defaultStatus: unaffected
cpes: cpe:/a:redhat:rhel_software_collections:3
}
{
vendor: Red Hat
product: Red Hat support for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: codehaus-plexus
defaultStatus: affected
cpes: cpe:/a:redhat:openshift_application_runtimes:1.0
}
{
product: Fedora 37
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: maven-source-plugin
defaultStatus: affected
}
{
product: Fedora 37
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: maven
defaultStatus: affected
}
{
product: Fedora 37
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: extra-enforcer-rules
defaultStatus: affected
}
{
product: Fedora 37
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: maven-antrun-plugin
defaultStatus: affected
}
{
product: Fedora 37
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: maven-plugin-bundle
defaultStatus: affected
}
{
product: Fedora 37
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: maven-compiler-plugin
defaultStatus: affected
}
{
product: Fedora 37
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: pomchecker
defaultStatus: affected
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]