CVE-2022-22932

🗓️ 26 Jan 2022 11:10:12Reported by apacheType

CVE-2022-22932 Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal, allowing breakout of expected folder. Risk is low as obr:* commands are not widely used and entry is set by user. Fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4. Mitigation: Upgrade to 4.2.15 or 4.3.6 or later, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-732

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2022-22932	26 Jan 202211:15	–	attackerkb
Circl	CVE-2022-22932	26 Jan 202214:19	–	circl
CNNVD	Apache Karaf 路径遍历漏洞	26 Jan 202200:00	–	cnnvd
CNVD	Apache Karaf path traversal vulnerability	27 Jan 202200:00	–	cnvd
Cvelist	CVE-2022-22932 Path traversal flaws	26 Jan 202211:10	–	cvelist
EUVD	EUVD-2022-0454	3 Oct 202520:07	–	euvd
Github Security Blog	Path traversal in Apache Karaf	28 Jan 202222:25	–	github
NVD	CVE-2022-22932	26 Jan 202211:15	–	nvd
OSV	CVE-2022-22932	26 Jan 202211:15	–	osv
OSV	GHSA-544X-2JX9-4PFG Path traversal in Apache Karaf	28 Jan 202222:25	–	osv

NVD

Vulners

Node

apache karafRange<4.2.15

apache karafRange4.3.0–4.3.6

[
  {
    "product": "Apache Karaf",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "changes": [
          {
            "at": "4.3.6",
            "status": "unaffected"
          }
        ],
        "lessThan": "4.2.15",
        "status": "affected",
        "version": "Apache Karaf",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
karaf	www.karaf.apache.org/security/cve-2022-22932.txt

21 Nov 2024 06:47Current

5.5Medium risk

Vulners AI Score5.5

CVSS 25

CVSS 3.15.3

EPSS0.00499

CWE-22