Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2019-25075

HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.

VectorNETWORK

PublishedAug 23, 2022, 01:15

Published Bycve@mitre.org

Base Score

Score6.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

io.gravitee.apim:gravitee-api-management(Maven)01.25.3N/A

References

https://github.com/gravitee-io/gravitee-api-management
https://medium.com/%40maxime.escourbiac/write-up-of-path-traversal-on-gravitee-io-8835941be69f

Weakness Type

CWE-79

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK