CVE-2022-23082

CureKit - Path Traversal in isFileOutsideDir

CVSS 7.5 HIGHEPSS 1.2%CWE-22

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

31 May 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

WhiteSource · CureKit

References

https://github.com/whitesource/CureKit/commit/af35e870ed09411d2f1fae6db1b04598cd1a31b6 https://www.mend.io/vulnerability-database/CVE-2022-23082