{"id":"GHSA-xc4w-28g8-vqm5","summary":"Path Traversal in Gravitee API Management ","details":"HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.","aliases":["CVE-2019-25075"],"modified":"2023-11-08T04:01:33.041749Z","published":"2022-08-24T00:00:31Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-08-30T20:55:17Z","nvd_published_at":"2022-08-23T01:15:00Z","cwe_ids":["CWE-22"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25075"},{"type":"PACKAGE","url":"https://github.com/gravitee-io/gravitee-api-management"},{"type":"WEB","url":"https://medium.com/@maxime.escourbiac/write-up-of-path-traversal-on-gravitee-io-8835941be69f"}],"affected":[{"package":{"name":"io.gravitee.apim:gravitee-api-management","ecosystem":"Maven","purl":"pkg:maven/io.gravitee.apim/gravitee-api-management"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-xc4w-28g8-vqm5/GHSA-xc4w-28g8-vqm5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}