CVE-2022-23082

CureKit - Path Traversal in isFileOutsideDir

State: Published
Severity: 7.5 High
Published: May 31, 2022
Updated: Sep 17, 2024
Reserved: Jan 10, 2022

Description

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	Mend

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
CureKitWhiteSource	v1.0.1 to before unspecifiedAffected v1.1.3 and earlierAffected

References

https://github.com/whitesource/CureKit/commit/af35e870ed09411d2f1fae6db1b04598cd1a31b6
https://www.mend.io/vulnerability-database/CVE-2022-23082

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.