CVE-2013-0136
NoneCVSS
—
EPSS
40.3%
Published
Jun 1, 2013
CISA due date
—
The record
Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | keycloak | 0 | 0 |
| Chainguard | keycloak-bitnami-compat | 0 | 0 |
| Chainguard | keycloak-compat | 0 | 0 |
| Chainguard | keycloak-iamguarded-compat | 0 | 0 |
| Wolfi | keycloak | 0 | 0 |
| Wolfi | keycloak-bitnami-compat | 0 | 0 |
| Wolfi | keycloak-compat | 0 | 0 |
| Wolfi | keycloak-iamguarded-compat | 0 | 0 |
Related vulnerabilities
- CVE-2025-55163 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Also affects keycloak
- CVE-2025-24970 SslHandler doesn't correctly validate packets which can lead to native crash when using… Also affects keycloak
- CVE-2025-25193 Denial of Service attack on windows app using Netty Also affects keycloak
- CVE-2024-9666 A vulnerability was found in the Keycloak Server. Also affects keycloak
- CVE-2024-47535 Netty is an asynchronous event-driven network application framework for rapid development… Also affects keycloak
- CVE-2024-30172 An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. Also affects keycloak
- CVE-2024-30171 An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Also affects keycloak
- CVE-2024-29857 An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java)… Also affects keycloak