CVE-2020-15124 json
Path traversal in Goobi viewer Core
published 2020-07-22 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-7226
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive information. The vulnerability has been fixed in version 4.8.3
Patch / fix
Exploit prediction
1.54% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- intranda goobi-viewer-core
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/intranda/goobi-viewer-core/commit/44ceb8e2e7e888391e8a941127171d6366770df3
patch, third-party-advisory
-
github.com
/intranda/goobi-viewer-core/security/advisories/GHSA-7gwq-xqw3-cr63
third-party-advisory
Sources
- CVE List CVE-2020-15124
- NVD CVE-2020-15124
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.