File Path Traversal Vulnerability in Eclipse Vert.x on Windows OS
CVE-2019-17640

9.8CRITICAL

Key Information:

Vendor: The Eclipse Foundation
Status: Eclipse Vert.x
Vendor: CVE Published:; 15 October 2020

🔔 Create The Eclipse Foundation Vulnerability Alert

What is CVE-2019-17640?

In Eclipse Vert.x versions 3.4.x through 3.9.4 and various 4.0.0 milestones, a flaw in the StaticHandler functionality can be exploited on Windows systems. The vulnerability enables attackers to manipulate backslashes, allowing them to bypass the designated webroot folder and access the current working directory. This behavior poses a risk by potentially exposing sensitive files and data, necessitating prompt remediation.

Affected Version(s)

Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, 4.0.0.Beta3