Search for vulnerabilities
Vulnerability details: VCID-zj3u-yaat-aaaj
Vulnerability ID VCID-zj3u-yaat-aaaj
Aliases CVE-2022-4244
GHSA-g6ph-x5wf-g337
Summary A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2023:2135
ssvc Track https://access.redhat.com/errata/RHSA-2023:2135
cvssv3.1 4.3 https://access.redhat.com/errata/RHSA-2023:3906
ssvc Track https://access.redhat.com/errata/RHSA-2023:3906
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-4244.json
cvssv3.1 7.5 https://access.redhat.com/security/cve/CVE-2022-4244
generic_textual HIGH https://access.redhat.com/security/cve/CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00112 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00266 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.00369 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.0059 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.0059 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
epss 0.01248 https://api.first.org/data/v1/epss?cve=CVE-2022-4244
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-g6ph-x5wf-g337
cvssv3.1 7.5 https://github.com/codehaus-plexus/plexus-utils/commit/33a2853df8185b4519b1b8bfae284f03392618ef
generic_textual HIGH https://github.com/codehaus-plexus/plexus-utils/commit/33a2853df8185b4519b1b8bfae284f03392618ef
cvssv3.1 7.5 https://github.com/codehaus-plexus/plexus-utils/issues/4
generic_textual HIGH https://github.com/codehaus-plexus/plexus-utils/issues/4
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-4244
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-4244
cvssv3.1 7.5 https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31521
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31521
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-4244.json
https://access.redhat.com/security/cve/CVE-2022-4244
https://api.first.org/data/v1/epss?cve=CVE-2022-4244
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4244
https://github.com/codehaus-plexus/plexus-utils/commit/33a2853df8185b4519b1b8bfae284f03392618ef
https://github.com/codehaus-plexus/plexus-utils/issues/4
https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31521
2149841 https://bugzilla.redhat.com/show_bug.cgi?id=2149841
cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:*
cpe:2.3:a:codehaus-plexus_project:codehaus-plexus:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:codehaus-plexus_project:codehaus-plexus:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:*
cpe:/a:redhat:amq_broker:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:amq_broker:7
cpe:/a:redhat:a_mq_clients:2 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:a_mq_clients:2
cpe:/a:redhat:amq_online:1 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:amq_online:1
cpe:/a:redhat:camel_k:1 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:camel_k:1
cpe:/a:redhat:camel_quarkus:2 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:camel_quarkus:2
cpe:/a:redhat:camel_spring_boot:3 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:camel_spring_boot:3
cpe:/a:redhat:integration:1 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:integration:1
cpe:/a:redhat:jboss_data_grid:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_data_grid:7
cpe:/a:redhat:jboss_data_grid:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jbosseapxp https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:jboss_enterprise_application_platform:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:6
cpe:/a:redhat:jboss_enterprise_application_platform:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_bpms_platform:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_bpms_platform:7
cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13
cpe:/a:redhat:jboss_enterprise_brms_platform:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_brms_platform:7
cpe:/a:redhat:jboss_enterprise_web_server:3 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_web_server:3
cpe:/a:redhat:jboss_enterprise_web_server:5 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_web_server:5
cpe:/a:redhat:jboss_fuse:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_fuse:6
cpe:/a:redhat:jboss_fuse:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:jboss_fuse_service_works:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_fuse_service_works:6
cpe:/a:redhat:openshift_application_runtimes:1.0 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:openshift_application_runtimes:1.0
cpe:/a:redhat:quarkus:2 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:quarkus:2
cpe:/a:redhat:red_hat_single_sign_on:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7
cpe:/a:redhat:rhel_software_collections:3 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_software_collections:3
cpe:/a:redhat:service_registry:2 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:service_registry:2
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
CVE-2022-4244 https://nvd.nist.gov/vuln/detail/CVE-2022-4244
GHSA-g6ph-x5wf-g337 https://github.com/advisories/GHSA-g6ph-x5wf-g337
RHSA-2023:2135 https://access.redhat.com/errata/RHSA-2023:2135
RHSA-2023:3906 https://access.redhat.com/errata/RHSA-2023:3906
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2023:2135
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-08T18:37:50Z/ Found at https://access.redhat.com/errata/RHSA-2023:2135
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/errata/RHSA-2023:3906
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-05-07T17:32:13Z/ Found at https://access.redhat.com/errata/RHSA-2023:3906
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-4244.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/security/cve/CVE-2022-4244
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codehaus-plexus/plexus-utils/commit/33a2853df8185b4519b1b8bfae284f03392618ef
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/codehaus-plexus/plexus-utils/issues/4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-4244
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-4244
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31521
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.45541
EPSS Score 0.00112
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.