CVE-2018-13864

A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-07-17

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Play Framework (Lightbend)

References

• https://www.playframework.com/security/vulnerability/CVE-2018-13864-PathTraversal