[QPID-8594] [Broker-J] File Disclosure in management-http plugin

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: qpid-java-broker-8.0.6
• Fix Version/s: qpid-java-broker-9.0.0
• Component/s: Broker-J
• Assignee: Unassigned
• Reporter: Daniil Kirilyuk
• Created: 15/Jul/22 06:52
• Updated: 11/Nov/22 12:25
• Resolved: 27/Oct/22 13:28

Description

Java broker HTTP management plugin invokes in filter RewriteRequestForUncompressedJavascript a server side forward using a path built with unvalidated input. This could allow an attacker to download application binaries or view arbitrary files within protected directories.