Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is
    ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot
    backslash) in a response to a recursive GET command. (CVE-2016-5725)

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote host is 16.2.x, 17.12.x prior to 17.12.11. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (JCraft JSch)). Supported versions that are affected are 17.12.0-17.12.10. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera     Gateway. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Primavera Gateway accessible data. (CVE-2016-5725)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Apache Groovy)). Supported versions that are affected are 17.12.0-17.12.10. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Primavera Gateway     executes to compromise Primavera Gateway. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Primavera Gateway accessible data.
    (CVE-2020-17521)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that there was a path traversal vulnerability in jsch, a pure Java implementation of the SSH2 protocol.

For Debian 8 'Jessie', this problem has been fixed in version 0.1.51-1+deb8u1.

We recommend that you upgrade your jsch packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a path traversal vulnerability in jsch, a pure Java implementation of the SSH2 protocol.

For Debian 7 'Wheezy', this issue has been fixed in jsch version 0.1.42-2+deb7u1.

We recommend that you upgrade your jsch packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
417856	SCA: security update for com.jcraft:jsch (GHSA-q446-82vq-w674)	Tenable Cloud Security	SCA Checks	Local	medium
417856	SCA: security update for com.jcraft:jsch (GHSA-q446-82vq-w674)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
148916	Oracle Primavera Gateway (Apr 2021 CPU)	Nessus	CGI abuses	Remote	medium
135976	Debian DLA-2184-1 : jsch security update	Nessus	Debian Local Security Checks	Local	medium
93323	Debian DLA-611-1 : jsch security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2016-5725

medium

Tenable Plugins

medium

medium

medium

medium

medium