2

How can we resolve a path traversal vulnerability that has been flagged in our DXA code? Any insights or solutions on how take to address this issue would be greatly appreciated.

URI: HEAD /path/to/file/sample.jpg

which was accessed within the following code:

com.sdl.dxa.tridion.content.GenericStaticContentResolver#getStaticContentFileByPath(), line 78
2
  • 1
    can you please share the Tridion and DXA version and what web server and operating system your DXA is currently running on. I see your tag that you are using dxa-java.
    – Anand N S
    Mar 31, 2023 at 8:07
  • Tridon Site 9.5, DXA version:2.2.28 , Running on docker conainer based on openjdk:8 image(alpine3.5 and Java 8u121)
    – fitnet
    Mar 31, 2023 at 15:44

1 Answer 1

2

Path Traversal security vulnerability. This issue has been fixed. (DXA 2.2.32 is available from Maven Central).

https://github.com/RWS/dxa-web-application-java/commit/35a66184b19c106e79dbeb63c906b9525a2f1796

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.