Vulnerability · Published Dec 14, 2022 · Assigned by VulDB

CVE-2022-4494bspkrs MCPMappingViewer ZIP File RemoteZipHandler.java extractZip path traversal

Medium 6.3

In plain English

A medium-severity path traversal in MCPMappingViewer from bspkrs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractZip of the file src/main/java/bspkrs/mmv/RemoteZipHandler.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack may be launched remotely. The name of the patch is 6e602746c96b4756c271d080dae7d22ad804a1bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215804.

Affected products (as reported)

Vendor	Product	Versions
bspkrs	MCPMappingViewer	n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References