Vulnerability · Published Dec 27, 2022 · Assigned by VulDB

CVE-2022-4772Widoco WidocoUtils.java unZipIt path traversal

Medium 4.5

In plain English

A medium-severity path traversal in Widoco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.5Medium

Exploit odds (30 days)0.3%top 77.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.github.dgarijo:Widoco	no fix listed	GHSA-jj8r-jw42-mw4w

Affected products (as reported)

Vendor	Product	Versions
n/a	Widoco	n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.216914 vdb-entry, technical-description
https://vuldb.com/?ctiid.216914 signature, permissions-required
https://github.com/dgarijo/Widoco/pull/551 issue-tracking
https://github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa92 patch