GHSA-g6ph-x5wf-g337
plexus-codehaus vulnerable to directory traversal
At a glance
- Published
- Updated
- CVE
- CVE-2022-4244
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
A flaw was found in plexus-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with dot-dot-slash (`../`) sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.codehaus.plexus:plexus-utils | introduced 0, fixed 3.0.24 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-4244 ADVISORY
- https://github.com/codehaus-plexus/plexus-utils/issues/4 WEB
- https://github.com/codehaus-plexus/plexus-utils/commit/33a2853df8185b4519b1b8bfae284f03392618ef WEB
- https://access.redhat.com/errata/RHSA-2023:2135 WEB
- https://access.redhat.com/errata/RHSA-2023:3906 WEB
- https://access.redhat.com/security/cve/CVE-2022-4244 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2149841 WEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31521 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |