CVE-2022-23457 Path Traversal in ESAPI

2022-04-2500:00:00

CWE-22

GitHub_M

www.cve.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.4%

JSON

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPath(String, String, File, boolean) may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the ‘input’ path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one’s own implementation of the Validator interface. However, maintainers do not recommend this.

CNA Affected

[
  {
    "vendor": "OWASP ESAPI",
    "product": "org.owasp.esapi:esapi",
    "versions": [
      {
        "version": "2.3.0.0",
        "status": "affected",
        "lessThan": "2.3.0.0",
        "versionType": "custom"
      }
    ]
  }
]