Vulnerability · Published Jan 26, 2022 · Assigned by apache

CVE-2022-22932Path traversal flaws

Medium 5.3

In plain English

A medium-severity security flaw in Apache Karaf from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)2.8%top 13.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.karaf:apache-karaf	4.3.6	GHSA-544x-2jx9-4pfg
Maven	org.apache.karaf:apache-karaf	4.2.15	GHSA-544x-2jx9-4pfg

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Karaf	Apache Karaf – before 4.2.15

References

https://karaf.apache.org/security/cve-2022-22932.txt x_refsource_MISC