CVE-2024-49771 — Path Traversal in Mpxj

CWE-22 — Path Traversal5 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 54.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MpxjJoniles Mpxj
Timeline
PublishedOct 28
Latest updateApr 15

Description

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶PyPImpxj/mpxj8.3.5 — 13.5.1
▶RubyGemsmpxj/mpxj8.3.5 — 13.5.1
▶CVEListV5joniles/mpxj>= 8.3.5, < 13.5.1

🔴Vulnerability Details

3
CVEList
MPXJ has a Potential Path Traversal Vulnerability↗2024-10-28
▶
OSV
MPXJ has a Potential Path Traversal Vulnerability↗2024-10-28
▶
GHSA
MPXJ has a Potential Path Traversal Vulnerability↗2024-10-28
▶

📋Vendor Advisories

1
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Platform (MPXJ) — CVE-2024-49771↗2025-04-15
▶
CVE-2024-49771 — Path Traversal in Mpxj | cvebase