// For flags

CVE-2018-1000850

retrofit: Directory traversal in RequestBuilder allows manipulation of resources

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack appear to be exploitable via An attacker should have access to an encoded path parameter on POST, PUT or DELETE request.. This vulnerability appears to have been fixed in 2.5.0 and later.

Square Retrofit, desde la versión 2.0 (incluida) y 2.5.0 (excluida), contiene una vulnerabilidad de salto de directorio en la clase RequestBuilder, método addPathParameter. Al manipular la URL, un atacante podría añadir o eliminar recursos que no estarían disponibles. Para que el ataque sea explotable, un atacante debería tener acceso a un parámetro path cifrado en las peticiones POST, PUT o DELETE. La vulnerabilidad parece haber sido solucionada en las versiones 2.5.0 y siguientes.

A flaw was found in Retrofit, where it allowed directory traversal via its RequestBuilder class. An attacker could use this flaw to access information or commands outside of its set permissions.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-11-25 CVE Reserved
  • 2018-12-20 CVE Published
  • 2024-05-12 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Squareup
Search vendor "Squareup"
 Retrofit
Search vendor "Squareup" for product "Retrofit"
 >= 2.0.0 < 2.5.0
Search vendor "Squareup" for product "Retrofit" and version " >= 2.0.0 < 2.5.0"
-
Affected