CyberRota Analysis
AI-GeneratedEclipse SW360 versions 19.0.0 through 20.1.0 are vulnerable to arbitrary file path traversal due to improper handling of uploaded filenames when configured to use file system storage. This vulnerability could allow an attacker to manipulate file paths, potentially leading to unauthorized access to sensitive files. Organizations using these versions should prioritize remediation by either disabling the file system storage feature or upgrading to the patched versions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The immediate workaround is to disable enable.attachment.store.to.file.system or update to fixed versions.