CVE-2023-34062 - Directory Traversal

Severity: None2024-02-22

Security Advisories

Abstract

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

The Oxygen products incorporate Reactor Netty HTTP Server as a third-party libraries. This advisory was opened to address the potential impact of this third-party libraries vulnerability.

Affected Products/Versions

ProductSeverityFixed Release Availability
Oxygen Content Fusion v6.0 and olderNone Oxygen Content Fusion 6.1 build 2024020213

Mitigation

None

Detail

CVE-2023-34062

Severity: High

CVSS Score: 7.5

The Reactor Netty HTTP Server third-party libraries used by Oxygen XML products are an affected version mentioned in CVE-2023-34062 vulnerability description. However, Reactor Netty HTTP Server in Oxygen XML products is not configured to serve static resources. For that reason, Oxygen XML products are not affected by this vulnerability.

List of Security Advisories