rootpwn

high · CVSS v3 7.5

CVE-2017-20284

Caucho Resin's documentation webapp (resin-doc) has a path traversal flaw that lets unauthenticated users read arbitrary files via the input

Overview

Caucho Resin's documentation webapp (resin-doc) has a path traversal flaw that lets unauthenticated users read arbitrary files via the inputFile parameter. The vulnerability can be exploited remotely without authentication. It was publicly reported in 2021 by Shadowserver.

Description

Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests with directory traversal sequences to the servlet endpoint to read files outside the intended tutorial directory on the underlying system. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-12-10.

Impact

Confidentiality: attackers can read sensitive files such as passwords, certificates, or configuration data. Availability is not directly impacted, but the information disclosure can lead to further attacks. The vulnerability affects all systems running the vulnerable Resin documentation webapp.

Remediation

Apply the latest Resin patch or upgrade to a supported version that removes the vulnerable servlet. If upgrading is not possible, disable or remove the resin-doc webapp and block external access to the jndi-appconfig endpoint. Ensure file system permissions restrict read access to sensitive files and monitor for anomalous requests.

Risk context

Severity is high with a CVSS v3 score of 7.5. No EPSS data is available, but the flaw allows remote unauthenticated file disclosure, making it a priority for remediation.

Affected products

  • Caucho Resin
  • Resin-doc
  • Resin webapp

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

path-traversal file-disclosure Resin webapp unauthenticated CVE-2017-20284

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-32641

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling, allowing repeated requests to deny service or cause container restart loops. This issue is fixed in version 3.0.0.

View analysis

high

CVE-2026-61552

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, escape the intended object, create additional objects, and exceed the user's assigned privileges. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.

View analysis