Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Details The problem lies in the way how the expanded javadoc files are served. The GET /javadoc/{repository}/<gav/raw/<resource route uses the <resource path parameter to find the file in the javadocUnpackPath directory and returns it's content to the user. JavadocFacade.kt#L77: In this case, the <resource path parameter can contain path traversal characters such as /../../. Since the path is concatenated with the main directory, it opens the possibility to read files outside the javadocUnpackPath directory. Impact This issue may lead to Arbitrary File Read on the server. A potential attacker can read some sensitive file, such as reposilite.db, that contains the sqlite database used by Reposilite. This database contains the sensitive information used by Reposilite, including passwords and hashes of issued tokens. Also, the configuration.cdn file can…
Recommended action: Upgrade to 3.5.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Reposilite v3.5.10 is affected by an Arbitrary File Upload vulnerability via path traversal in expanding of Javadoc archives. Details Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller allows to expand the javadoc archive into the server's file system and return its content. The problem is in the way how the archives are expanded, specifically how the new filename is created: JavadocContainerService.kt#L127-L136 The file.name taken from the archive can contain path traversal characters, such as '/../../../anything.txt', so the resulting extraction path can be outside the target directory. Impact If the archive is taken from an untrusted source, such as Maven Central or JitPack for example, an attacker can craft a special archive to overwrite any local file on Reposilite instance. This could lead to remote code execution, for example by placing a new plugin into the…
Recommended action: Upgrade to 3.5.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Reposilite v3.5.10 is affected by Stored Cross-Site Scripting (XSS) when displaying artifact's content in the browser. Details As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The problem lies in the fact that the artifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact contains HTML content with javascript inside, the javascript is executed within the same origin. Therefore, if an authenticated user is viewing the artifacts content, the javascript inside can access the browser's local storage where the user's password (aka 'token-secret') is stored. It is especially dangerous in scenarios where Reposilite is configured to mirror third party repositories, like the Maven Central Repository. Since anyone can publish an artifact to Maven Central under its own name, such malicious packages can be used to attack the Reposilite…
Recommended action: Upgrade to 3.5.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.