Medium severity5.3OSV Advisory· Published Oct 28, 2024· Updated Apr 15, 2026
CVE-2024-49771
CVE-2024-49771
Description
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
net.sf.mpxj:mpxjMaven | >= 8.3.5, < 13.5.1 | 13.5.1 |
mpxjRubyGems | >= 8.3.5, < 13.5.1 | 13.5.1 |
mpxjPyPI | >= 8.3.5, < 13.5.1 | 13.5.1 |
net.sf.mpxjNuGet | >= 8.3.5, < 13.5.1 | 13.5.1 |
net.sf.mpxj-for-csharpNuGet | >= 8.3.5, < 13.5.1 | 13.5.1 |
net.sf.mpxj-for-vbNuGet | >= 8.3.5, < 13.5.1 | 13.5.1 |
MPXJ.NetNuGet | >= 13.0.0, < 13.5.1 | 13.5.1 |
Affected products
8- ghsa-coords7 versionspkg:gem/mpxjpkg:maven/net.sf.mpxj/mpxjpkg:nuget/mpxj.netpkg:nuget/net.sf.mpxjpkg:nuget/net.sf.mpxj-for-csharppkg:nuget/net.sf.mpxj-for-vbpkg:pypi/mpxj
>= 8.3.5, < 13.5.1+ 6 more
- (no CPE)range: >= 8.3.5, < 13.5.1
- (no CPE)range: >= 8.3.5, < 13.5.1
- (no CPE)range: >= 13.0.0, < 13.5.1
- (no CPE)range: >= 8.3.5, < 13.5.1
- (no CPE)range: >= 8.3.5, < 13.5.1
- (no CPE)range: >= 8.3.5, < 13.5.1
- (no CPE)range: >= 8.3.5, < 13.5.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-j945-c44v-97g6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-49771ghsaADVISORY
- github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0nvdWEB
- github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6nvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/mpxj/CVE-2024-49771.ymlghsaWEB
News mentions
0No linked articles in our index yet.