Widoco WidocoUtils.java unZipIt 目录遍历

在Widoco 中曾发现分类为致命的漏洞。 受此问题影响的是功能unZipIt文件：src/main/java/widoco/WidocoUtils.java。 手动调试的不合法输入可导致 目录遍历。 使用CWE来声明会导致 CWE-22 的问题。 此漏洞的脆弱性 2022-12-27公示人身份551、所分享。 索取公告的网址是github.com。 该漏洞被处理的名称为CVE-2022-4772， 攻击可能对本地主机发起。 有技术细节可用。 没有可利用漏洞。 目前漏洞的结构决定了可能的价格范围为美元价USD $0-$5k。 该漏洞由MITRE ATT&CK项目分配为T1006。 它被宣布为未定义。 估计零日攻击的地下价格约为$0-$5k。 补丁名称为f2279b76827f32190adfa9bd5229b7d5a147fa92。 错误修复程序下载地址为github.com， 建议采用一个补丁来修正此问题。 该漏洞被披露后，远在此前发表过可能的缓解措施。

字段2022-12-27 23時52分2023-01-25 09時56分2023-01-25 10時00分
nameWidocoWidocoWidoco
filesrc/main/java/widoco/WidocoUtils.javasrc/main/java/widoco/WidocoUtils.javasrc/main/java/widoco/WidocoUtils.java
functionunZipItunZipItunZipIt
cwe22 (目录遍历)22 (目录遍历)22 (目录遍历)
risk222
cvss3_vuldb_avLLL
cvss3_vuldb_acHHH
cvss3_vuldb_prLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifier551551551
urlhttps://github.com/dgarijo/Widoco/pull/551https://github.com/dgarijo/Widoco/pull/551https://github.com/dgarijo/Widoco/pull/551
name补丁补丁补丁
patch_namef2279b76827f32190adfa9bd5229b7d5a147fa92f2279b76827f32190adfa9bd5229b7d5a147fa92f2279b76827f32190adfa9bd5229b7d5a147fa92
patch_urlhttps://github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa92https://github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa92https://github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa92
cveCVE-2022-4772CVE-2022-4772CVE-2022-4772
responsibleVulDBVulDBVulDB
date1672095600 (2022-12-27)1672095600 (2022-12-27)1672095600 (2022-12-27)
cvss2_vuldb_avLLL
cvss2_vuldb_acHHH
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_eXXX
cvss2_vuldb_basescore3.53.53.5
cvss2_vuldb_tempscore3.03.03.0
cvss3_vuldb_basescore4.54.54.5
cvss3_vuldb_tempscore4.34.34.3
cvss3_meta_basescore4.54.55.6
cvss3_meta_tempscore4.34.35.5
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1672095600 (2022-12-27)1672095600 (2022-12-27)
cve_nvd_summaryA vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.
cvss3_nvd_avL
cvss3_nvd_acL
cvss3_nvd_prL
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss3_cna_avL
cvss3_cna_acH
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss3_nvd_basescore7.8
cvss3_cna_basescore4.5

◂ 上一步一览下一步 ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!