GitHub Advisoryadvisory · Maven

GHSA-cmwm-45mj-mpg3 SCIFIO vulnerable to Path Traversal

CRITICAL Published 2022-12-14 Modified 2022-12-16 Official page ↗
Aliases
CVE-2022-4493
Ecosystem
Maven
Packages
io.scif:scifio
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2022-12-16

Affected packages

• Maven io.scif:scifio: < 0.43.3 → fixed in 0.43.3

Description

A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The patch is at commit fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.

Related

Alias · CVE (1)

  • CVE-2022-4493 A vulnerability classified as critical was found in scifio. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References