CVE-2016-5725: jcraft jsch Path Traversal
CVSS: 5.9v3.0MediumModified
AliasesMGASA-2016-0311SUSE-SU-2017:0715-1DEBIAN-CVE-2016-5725DLA-2184-1DLA-611-1CGA-295q-2hp8-9qh8CGA-2g2f-h7gx-r3pwCGA-393r-fxmq-g6j7CGA-39g7-8hf3-r65mCGA-3hvm-727v-5r8fCGA-469j-75c5-q35rCGA-5cmx-9mxr-862qCGA-5gr8-2mcg-gq6qCGA-6664-66r9-8v22CGA-6c6g-p3pr-5r6cCGA-6vh8-7wfq-45h6CGA-7264-prgg-gmrvCGA-75wc-w75v-xq85CGA-78x6-8vg4-q8grCGA-7hww-784x-mcmfCGA-7x9q-c88f-5fw9CGA-84wr-8jf4-pm82CGA-873h-9r8v-xwc7CGA-8mc5-p83f-rhx7CGA-8mjf-c354-mqvqCGA-937p-72gp-c7hjCGA-956w-2jjf-2593CGA-fpxr-fg77-744rCGA-fr53-gc85-v2pwCGA-g2vp-wm55-mxw9CGA-g989-3hpp-8hvwCGA-ghrc-96h3-9wr8CGA-gpq3-53mx-jj5jCGA-gq26-cpcr-jhpmCGA-gqxc-j78x-vfwmCGA-gw55-qxv7-jwrgCGA-gx59-f2jv-5fv9CGA-j36v-6pjm-2wcwCGA-jmq6-xjvv-cv2rCGA-m337-r87p-p3ccCGA-mpjg-27q2-45rrCGA-p2xf-x758-wv7hCGA-p94j-qm2v-8452CGA-pf7q-9c25-gr4cCGA-pvg4-69wp-7vv6GHSA-q446-82vq-w674CGA-qpfq-hj5r-99fqCGA-qrg5-hmfh-g683CGA-qv6w-rxx6-fm94CGA-r3g4-g4mv-p54cCGA-r5mj-73mj-gjm7CGA-r777-2h9r-gc49CGA-rmx7-fj6j-ggjvCGA-v88p-g73f-jw34CGA-vf8j-7vfg-5x4fCGA-vv6w-7rqx-55jqCGA-w4x5-rcfp-57w2CGA-w633-gvm6-782jCGA-w739-c4fg-v9vgCGA-wg3m-cx62-f35gCGA-wjv4-vq8w-xm9gCGA-wq3g-xmfc-pvxgCGA-xh4p-7hp7-rg7vCGA-xrxf-8r4m-5cfc
Published 19-01-2017Last modified 06-08-2024
Vulnerability summary
CVE-2016-5725 is a medium (CVSS 5.9) Path Traversal vulnerability in jcraft jsch. EPSS estimates a 24.14% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.9/10
010
Medium · v3.0 (NVD)EPSS score
24.14%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 19-01-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 5.9Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 4 agree
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · MavenEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
24.14%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 24.14% on 19-09-2026
19-09-202619-10-2026
EPSS score24.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundJCraft/JSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard28 products
- eco-java-gradle-1.11All versions (No fix recorded)
- eco-java-gradle-2.0All versions (No fix recorded)
- eco-java-gradle-2.1All versions (No fix recorded)
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
Com.jcraft1 product
- jsch< 0.1.54
Debian1 product
- jsch< 0.1.54-1 | < 0.1.51-1+deb8u1 | < 0.1.42-2+deb7u1
Jcraft1 product
- jsch≤ 0.1.53
Mageia1 product
- jsch< 0.1.51-4.1.mga5
Suse1 product
- jsch&distro=SUSE Manager Server 3.0< 0.1.54-3.1
6 vendors · 33 products
References
20 links- seclists.org/fulldisclosure/2016/Sep/53Mailing ListX Refsource FULLDISCThird Party AdvisoryAdvisoryWEB
- www.exploit-db.com/exploits/40411/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB EntryAdvisory
- packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.htmlX Refsource MISCThird Party AdvisoryVDB EntryAdvisoryWEB
- github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725X Refsource MISCThird Party AdvisoryAdvisoryWEB
Show all 20 references
- bugzilla.suse.com/997542REPORT
