Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nNnBoLXg1d2YtZzMzN84AA2Cg

plexus-codehaus vulnerable to directory traversal

A flaw was found in plexus-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with dot-dot-slash (../) sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.

Permalink: https://github.com/advisories/GHSA-g6ph-x5wf-g337
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNnBoLXg1d2YtZzMzN84AA2Cg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 7 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00112
EPSS Percentile: 0.45524

Identifiers: GHSA-g6ph-x5wf-g337, CVE-2022-4244
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-4244
• https://access.redhat.com/errata/RHSA-2023:3906
• https://access.redhat.com/security/cve/CVE-2022-4244
• https://bugzilla.redhat.com/show_bug.cgi?id=2149841
• https://github.com/codehaus-plexus/plexus-utils/issues/4
• https://github.com/codehaus-plexus/plexus-utils/commit/33a2853df8185b4519b1b8bfae284f03392618ef
• https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31521
• https://access.redhat.com/errata/RHSA-2023:2135
• https://github.com/advisories/GHSA-g6ph-x5wf-g337

Repository: https://github.com/codehaus-plexus/plexus-utils
Blast Radius: 31.0

Affected Packages