GitHub_MCVELIST:CVE-2022-24774CVE-2022-24774 Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
8.2 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
46.5%
CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the appsettings.json file, or alternatively, setting the environment variables ALLOWEDMETHODS__POST and ALLOWEDMETHODS__DELETE to false.
CNA Affected
[
{
"product": "cyclonedx-bom-repo-server",
"vendor": "CycloneDX",
"versions": [
{
"status": "affected",
"version": "< 2.0.1"
}
]
}
]Related
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
8.2 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
46.5%