Advisory details:
vulnrichment / CVE-2022-24823
| Advisory ID | vulnrichment/CVE-2022-24823 |
| Aliases | |
| Summary | Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 5.5 | |
| ssvc | Track |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/netty/netty/commit/185f8b2756a36aaa4f973f1a2a025e7d981823f1 | ||
| https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 | ||
| cpujul2022.html | Other | https://www.oracle.com/security-alerts/cpujul2022.html |
| GHSA-269q-hmxg-m83q | https://github.com/netty/netty/security/advisories/GHSA-269q-hmxg-m83q | |
| ntap-20220616-0004 | Other | https://security.netapp.com/advisory/ntap-20220616-0004/ |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:48:11Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2022/24xxx/CVE-2022-24823.json
Source Advisory: vulnrichment/CVE-2022-24823
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]