CVE-2022-25882

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada linuxfoundation onnx. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"

Rincian

Terbit di NVD

26 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/onnx/onnx/commit/f369b0e859024095d721f1d1612da5a8fa38988d patch · advisory pihak ketiga
• https://github.com/onnx/onnx/pull/4400 patch · advisory pihak ketiga
• https://gist.github.com/jnovikov/02a9aff9bf2188033e77bd91ff062856 exploit · advisory pihak ketiga
• https://github.com/onnx/onnx/issues/3991 exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479 exploit · advisory pihak ketiga
• https://github.com/onnx/onnx/blob/96516aecd4c110b0ac57eba08ac236ebf7205728/onnx/checker.cc%23L129 broken link