CVE-2018-1000850
High
Description
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack appear to be exploitable via An attacker should have access to an encoded path parameter on POST, PUT or DELETE request.. This vulnerability appears to have been fixed in 2.5.0 and later.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSquareup Retrofit
PublishedDec 20, 2018
First seenDec 20, 2018
How to fix
Update
- squareup retrofit2.5.0 or later
- com.squareup.retrofit2:retrofit2.5.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squareup retrofit | 2.0.0 ≤ v < 2.5.0 | 2.5.0 |
| com.squareup.retrofit2:retrofitMaven | 2.0.0 ≤ v < 2.5.0 | 2.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.