CVE-2022-23457 Path Traversal in ESAPI

2022-04-2500:00:00

CWE-22

GitHub_M

www.cve.org

owasp

esapi

path traversal

security control

validator

directory path

vulnerability

patched

implementation

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.003

Percentile

69.3%

JSON

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPath(String, String, File, boolean) may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the ‘input’ path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one’s own implementation of the Validator interface. However, maintainers do not recommend this.

CNA Affected

[
  {
    "vendor": "OWASP ESAPI",
    "product": "org.owasp.esapi:esapi",
    "versions": [
      {
        "version": "2.3.0.0",
        "status": "affected",
        "lessThan": "2.3.0.0",
        "versionType": "custom"
      }
    ]
  }
]