CVE-2024-35219
High
Description
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.
SeverityHigh
CVSS8.3
Exploit probability—
ProductOrg.openapitools:openapi-generator-online
PublishedMay 27, 2024
First seenMay 27, 2024
Weakness typeCWE-22Path traversal
How to fix
Update
- org.openapitools:openapi-generator-online7.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.openapitools:openapi-generator-onlineMaven | v < 7.6.0 | 7.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.