Log in Start free

Vulnerability · Published Sep 25, 2023 · Assigned by redhat

CVE-2022-4244Codehaus-plexus: directory traversal

High 7.5

In plain English

A high-severity path traversal in A-MQ Clients 2 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 28.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12plexus-utils23.0.24-1DEBIAN-CVE-2022-4244
Debian:13plexus-utils23.0.24-1DEBIAN-CVE-2022-4244
Debian:14plexus-utils23.0.24-1DEBIAN-CVE-2022-4244
Mavenorg.codehaus.plexus:plexus-utils3.0.24GHSA-g6ph-x5wf-g337

Affected products (as reported)

VendorProductVersions
Red Hat RHINT Camel-K-1.10.1 see references
Red Hat RHPAM 7.13.1 async see references
Red Hat A-MQ Clients 2 see references
Red Hat Red Hat A-MQ Online see references
Red Hat Red Hat build of Apache Camel for Spring Boot see references
Red Hat Red Hat build of Quarkus see references
Red Hat Red Hat Data Grid 8 see references
Red Hat Red Hat Decision Manager 7 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Integration Camel Quarkus see references
Red Hat Red Hat Integration Change Data Capture see references
Red Hat Red Hat Integration Service Registry see references
Red Hat Red Hat JBoss A-MQ 7 see references
Red Hat Red Hat JBoss Data Grid 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references
Red Hat Red Hat JBoss Fuse 6 see references
Red Hat Red Hat JBoss Fuse 7 see references
Red Hat Red Hat JBoss Fuse Service Works 6 see references
Red Hat Red Hat JBoss Web Server 3 see references
Red Hat Red Hat JBoss Web Server 5 see references
Red Hat Red Hat OpenShift Application Runtimes see references
Red Hat Red Hat Process Automation 7 see references
Red Hat Red Hat Single Sign-On 7 see references
Red Hat Red Hat Software Collections see references

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References