Lucene search

GoogleOSV:CVE-2022-23553

HistoryDec 28, 2022 - 7:15 p.m.

CVE-2022-23553

2022-12-2819:15:09

Google

osv.dev

alpine

java

url access filter

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are no known workarounds.

CPENameOperatorVersion
alpineeqalpine-parent-1.1.0
alpineeqalpine-executable-war-1.1.2
alpineeqalpine-executable-war-1.3.0
alpineeqalpine-executable-war-1.0.1
alpineeqalpine-executable-war-1.2.7
alpineeqalpine-parent-1.3.0
alpineeqalpine-parent-1.7.0
alpineeqalpine-parent-1.10.2
alpineeqalpine-parent-1.10.1
alpineeqalpine-executable-war-1.0.2

Name	Operator	Version
alpine	eq	alpine-parent-1.1.0
alpine	eq	alpine-executable-war-1.1.2
alpine	eq	alpine-executable-war-1.3.0
alpine	eq	alpine-executable-war-1.0.1
alpine	eq	alpine-executable-war-1.2.7
alpine	eq	alpine-parent-1.3.0
alpine	eq	alpine-parent-1.7.0
alpine	eq	alpine-parent-1.10.2
alpine	eq	alpine-parent-1.10.1
alpine	eq	alpine-executable-war-1.0.2

Rows per page:

1-10 of 461

References

github.com/stevespringett/Alpine/blob/alpine-parent-1.10.2/alpine/src/main/java/alpine/filters/BlacklistUrlFilter.java#L107-L121

github.com/stevespringett/Alpine/blob/alpine-parent-1.10.2/alpine/src/main/java/alpine/filters/WhitelistUrlFilter.java#L115-L127

securitylab.github.com/advisories/GHSL-2021-1009-Alpine/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

Related for OSV:CVE-2022-23553