CVE-2024-49771

CVE-2024-49771 · MPXJ has a Potential Path Traversal Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published: 2024-10-28T16:57:43.271Z
Updated: 2024-10-29T13:37:18.103Z

Stack: python

Affected products and versions

mpxj
Versions
- >= 8.3.5, < 13.5.1: Affected
No fix published
net.sf.mpxj:mpxj Maven
Versions
- 10.0.0
- 10.0.1
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
Affected ranges
- ECOSYSTEM: ≥ 8.3.5, < 13.5.1
Update to 13.5.1
mpxj RubyGems
Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.5.0
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
Affected ranges
- ECOSYSTEM: ≥ 8.3.5, < 13.5.1
Update to 13.5.1
mpxj PyPI
Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
Affected ranges
- ECOSYSTEM: ≥ 8.3.5, < 13.5.1
Update to 13.5.1
net.sf.mpxj NuGet
Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
Affected ranges
- ECOSYSTEM: ≥ 8.3.5, < 13.5.1
Update to 13.5.1
net.sf.mpxj-for-csharp NuGet
Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
Affected ranges
- ECOSYSTEM: ≥ 8.3.5, < 13.5.1
Update to 13.5.1
net.sf.mpxj-for-vb NuGet
Versions
- 10.0.0
- 10.0.1
- 10.0.2
- 10.0.3
- 10.0.4
- 10.0.5
- 10.1.0
- 10.10.0
- 10.11.0
- 10.12.0
- 10.13.0
- 10.14.0
- 10.14.1
- 10.15.0
- 10.16.0
- 10.16.1
- 10.16.2
- 10.2.0
- 10.3.0
- 10.4.0
- 10.5.0
- 10.6.0
- 10.6.1
- 10.6.2
- 10.7.0
- 10.8.0
- 10.9.0
- 10.9.1
- 11.0.0
- 11.1.0
- 11.2.0
- 11.3.0
- 11.3.1
- 11.3.2
- 11.4.0
- 11.5.0
- 11.5.1
- 11.5.2
- 11.5.3
- 11.5.4
- 12.0.0
- 12.0.1
- 12.0.2
- 12.1.0
- 12.1.1
- 12.1.2
- 12.1.3
- 12.10.0
- 12.10.1
- 12.10.2
- 12.10.3
- 12.2.0
- 12.3.0
- 12.4.0
- 12.5.0
- 12.6.0
- 12.7.0
- 12.8.0
- 12.8.1
- 12.9.0
- 12.9.1
- 12.9.2
- 12.9.3
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.2.0
- 13.2.1
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
- 8.3.5
- 8.4.0
- 8.5.0
- 8.5.1
- 9.0.0
- 9.1.0
- 9.2.0
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.3.0
- 9.3.1
- 9.4.0
- 9.5.0
- 9.5.1
- 9.5.2
- 9.6.0
- 9.7.0
- 9.8.0
- 9.8.1
- 9.8.2
- 9.8.3
Affected ranges
- ECOSYSTEM: ≥ 8.3.5, < 13.5.1
Update to 13.5.1
mpxj.net NuGet
Versions
- 13.0.0
- 13.0.1
- 13.0.2
- 13.1.0
- 13.2.0
- 13.2.1
- 13.2.2
- 13.3.0
- 13.3.1
- 13.4.0
- 13.4.1
- 13.4.2
- 13.5.0
Affected ranges
- ECOSYSTEM: ≥ 13.0.0, < 13.5.1
Update to 13.5.1

Original sources

Check your server →

CVE-2024-49771 · MPXJ has a Potential Path Traversal Vulnerability

Affected products and versions

mpxj

net.sf.mpxj:mpxj Maven

mpxj RubyGems

mpxj PyPI

net.sf.mpxj NuGet

net.sf.mpxj-for-csharp NuGet

net.sf.mpxj-for-vb NuGet

mpxj.net NuGet

Original sources