Analyst readout for executives and security teams
Plain-English summary
This affects apps using vulnerable Square Retrofit client code. If attacker-controlled encoded path values are used in modifying requests, URL path handling may reach resources the caller should not access, potentially adding or deleting unintended resources.
Executive priority
Treat as a targeted dependency remediation item, not an emergency based on current evidence. Prioritize externally reachable or partner-facing services where Retrofit builds modifying requests from user-controlled path data.
Technical view
CVE-2018-1000850 is a directory traversal issue in Retrofit RequestBuilder.addPathParameter for versions from 2.0 through before 2.5.0. The CVE states exploitation requires access to an encoded path parameter on POST, PUT, or DELETE requests. The issue is reported fixed in 2.5.0 and later.
Likely exposure
Exposure is most likely in Java or Android services using Retrofit 2.0 to before 2.5.0 and accepting untrusted encoded path parameters for state-changing API calls. The source bundle lacks CPEs and complete product enumeration.
Exploitation context
The source bundle does not show KEV listing or active exploitation evidence. Practical risk depends on whether attacker-controlled encoded path segments reach Retrofit path parameters in modifying requests.
Researcher notes
NVD-style metadata in the bundle is sparse: severity, CVSS, CWE, CPE, and affected vendor/product fields are missing or unknown. The strongest concrete facts are the vulnerable version range, affected method, exploitation precondition, and fixed version stated in the CVE description.
Mitigation direction
- Inventory applications and dependencies using Square Retrofit.
- Upgrade Retrofit to version 2.5.0 or later.
- Prioritize services with POST, PUT, or DELETE calls using encoded path parameters.
- Check vendor and downstream package guidance for affected bundled dependencies.
Validation and detection
- Review SBOMs, lockfiles, and build manifests for Retrofit versions before 2.5.0.
- Identify Retrofit interfaces using path parameters in state-changing requests.
- Confirm untrusted encoded path values are rejected, constrained, or safely handled.
- Add regression tests for unsafe encoded path handling without documenting offensive payloads.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
File access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-1000850 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/square/retrofit/blob/master/CHANGELOG.mdCVE reference · x_refsource_MISC
- https://github.com/square/retrofit/commit/b9a7f6ad72073ddd40254c0058710e87a073047d#diff-943ec7ed35e68201824904d1dc0ec982CVE reference · x_refsource_MISC
- https://ihacktoprotect.com/post/retrofit-path-traversal/CVE reference · x_refsource_MISC
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesCVE reference · mailing-list, x_refsource_MLIST
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesCVE reference · mailing-list, x_refsource_MLIST
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesCVE reference · mailing-list, x_refsource_MLIST
- RHSA-2019:3892CVE reference · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.