CVE-2018-1306

Description

The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.

Weakness classification

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

• security@apache.org — Mitigation, Vendor Advisory
• security@apache.org — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry