High severity7.5OSV Advisory· Published Mar 21, 2019· Updated Jun 17, 2026

CVE-2018-11789

Description

When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the directory you would like to view. i.e. ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd.

Affected products

Apache/Incubator HeronOSV
Apache/Heron
cpe:2.3:a:apache:heron:*:*:*:*:*:*:*:*
Range: >=0.13.0,<=0.17.8
Apache/heron-uillm-create

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/107430nvdThird Party AdvisoryVDB Entry
lists.apache.org/thread.html/5ea1a102d87a47c5912d745fa0d5dfa2830fc94099cbc30911f095b9%40%3Cdev.heron.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000