CVE-2022-29253

Katalog CVE

CVSS 2.7 · Low EPSS 1,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada xwiki. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patched in versions 14.0 and 13.10.3. There is no easy workaround for this issue.

Rincian

Terbit di NVD

25 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-24: Path Traversal: '../filedir'

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.xwiki.org/browse/XWIKI-19349 advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/4917c8f355717bb636d763844528b1fe0f95e8e2 patch · advisory pihak ketiga
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9qrp-h7fw-42hg advisory pihak ketiga