GitHub Advisoryadvisory · Maven

GHSA-m9vj-44f3-78xw Path traversal in CureKit

HIGH Published 2022-06-01 Modified 2022-06-03 Official page ↗
Aliases
CVE-2022-23082
Ecosystem
Maven
Packages
io.whitesource:curekit
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-06-03

Affected packages

• Maven io.whitesource:curekit: >= 1.0.1, < 1.1.4 → fixed in 1.1.4

Description

CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function `isFileOutsideDir` fails to sanitize the user input which may lead to path traversal.

Related

Alias · CVE (1)

  • CVE-2022-23082 In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References