CVE-2023-29986: Path Traversal

Published May 11, 2023

Updated

spring-boot-actuator-logview 0.2.13 allows Directory Traversal to sibling directories via LogViewEndpoint.view.

Other sources

spring-boot-actuator-logview could allow a remote attacker to traverse directories on the system, caused by improper validation of user requests. An attacker could send a specially crafted URL request to the LogViewEndpoint.view script containing "dot dot" sequences (/../) to access arbitrary files on the system.

— IBM

Affected Software

1 affected component

Spring-boot-actuator-logview Project Spring-boot-actuator-logview=0.2.13

Event History

May 11, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Mar 20, 2024

Data Sourced

via IBM·12:00 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7144861

Frequently Asked Questions

What is the severity of CVE-2023-29986?

CVE-2023-29986 has a high severity level due to the potential for remote directory traversal attacks.

How do I fix CVE-2023-29986?

To fix CVE-2023-29986, upgrade spring-boot-actuator-logview to version 0.2.14 or later which addresses this vulnerability.

What impact does CVE-2023-29986 have on my system?

CVE-2023-29986 allows an attacker to access files outside the intended directory, potentially exposing sensitive information.

Which versions are affected by CVE-2023-29986?

CVE-2023-29986 specifically affects the spring-boot-actuator-logview version 0.2.13.

Is CVE-2023-29986 being actively exploited?

As of now, there are no confirmed reports of active exploitation of CVE-2023-29986, but it is advisable to mitigate the risk immediately.