Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter that can result in By manipulating the URL an attacker could add or delete resources otherwise unavailable to her.. This attack appear to be exploitable via An attacker should have access to an encoded path parameter on POST, PUT or DELETE request.. This vulnerability appears to have been fixed in 2.5.0 and later.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.squareup.retrofit2:retrofit (Maven) | 2.0.0 to before 2.5.0 | 2.5.0 | Patch available | GHSA-8p8g-f9vg-r7xr |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.squareup.retrofit2:retrofit (Maven) Vendor— Affected 2.0.0 to before 2.5.0 Fixed in 2.5.0 Patch available GHSA-8p8g-f9vg-r7xr
Remediation
- Fix · GHSA-8p8g-f9vg-r7xr com.squareup.retrofit2:retrofit (Maven) Fixed in 2.5.0 Advisory →
Red Hat 1 advisory
- RHSA-2019:3892 Released 2019-11-14 · Red Hat rating ImportantRed Hat Fuse 7.5.0 security update
- Red Hat Fuse 7.5.0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7.5.0 | Fixed | RHSA-2019:3892 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000850
- 2026-10-03 Alias added: GHSA-8p8g-f9vg-r7xr
References
Advisory 4
Other 8
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- https://github.com/square/retrofit
- https://ihacktoprotect.com/post/retrofit-path-traversal
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
More Squareup Retrofit vulnerabilities
- TI-2018-16066 Square Open Source Retrofit version Prior to commit… CVSS 3.0CRITICAL 9.1
Sources
- CVE-2018-1000850 · CVE Program
- CVE-2018-1000850 · NVD
- FIRST EPSS
- GHSA-8p8g-f9vg-r7xr · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1000850 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences