diff --git a/advisories/unreviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json b/advisories/github-reviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json similarity index 68% rename from advisories/unreviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json rename to advisories/github-reviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json index 6852587c86a..7f58e63f1c6 100644 --- a/advisories/unreviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json +++ b/advisories/github-reviewed/2025/03/GHSA-9q4x-fr4m-jp86/GHSA-9q4x-fr4m-jp86.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9q4x-fr4m-jp86", - "modified": "2025-03-24T15:30:44Z", + "modified": "2025-03-25T03:21:10Z", "published": "2025-03-23T15:30:33Z", "aliases": [ "CVE-2025-27553" ], + "summary": "Apache Commons VFS Has Relative Path Traversal Vulnerability", "details": "Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0.\n\nThe FileObject API in Commons VFS has a 'resolveFile' method that\ntakes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that \"an exception is thrown if the resolved file is not a descendent of\nthe base file\". However, when the path contains encoded \"..\"\ncharacters (for example, \"%2E%2E/bar.txt\"), it might return file objects that are not\na descendent of the base file, without throwing an exception.\nThis issue affects Apache Commons VFS: before 2.10.0.\n\nUsers are recommended to upgrade to version 2.10.0, which fixes the issue.", "severity": [ { @@ -13,12 +14,36 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.commons:commons-vfs2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27553" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/commons-vfs" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/cnzqowyw9r2pl263cylmxhnvh41hyjcb" @@ -33,8 +58,8 @@ "CWE-23" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-25T03:21:09Z", "nvd_published_at": "2025-03-23T15:15:13Z" } } \ No newline at end of file