Vert\.x\-Web - Vulncode-DB

Repositories	Unknown: This might be proprietary software.
#Vulnerabilities	2

Date	Id	Summary	Products	Score	Patch	Annotated
2023-02-09	CVE-2023-24815	Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return "/" + rest;` from `Utils.java` returns the user input (without...	Vert\.x\-Web	5.3
2021-01-20	CVE-2020-35217	Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful...	Vert\.x\-Web	8.8