Severity: None2024-02-22
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
The Oxygen products incorporate Reactor Netty HTTP Server as a third-party libraries. This advisory was opened to address the potential impact of this third-party libraries vulnerability.
| Product | Severity | Fixed Release Availability |
| Oxygen Content Fusion v6.0 and older | None | Oxygen Content Fusion 6.1 build 2024020213 |
CVE-2023-34062
Severity: High
CVSS Score: 7.5
The Reactor Netty HTTP Server third-party libraries used by Oxygen XML products are an affected version mentioned in CVE-2023-34062 vulnerability description. However, Reactor Netty HTTP Server in Oxygen XML products is not configured to serve static resources. For that reason, Oxygen XML products are not affected by this vulnerability.
This website was created & generated with <oXygen/>®XML Editor
