cve.bz

CVE-2018-12036

7.8 highEPSS 1.7%

High (7.8) in owasp dependency-check. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in org.owasp:dependency-check-maven 3.2.0.

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.

Severity

CVSS 3.0

7.8 high
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWEs
CWE-22, CWE-123
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-hcwx-7q5v-vc67Mavenorg.owasp:dependency-check-maven<3.2.03.2.0

References

Check your stackJSON