CVE-2022-41951

Katalog CVE

CVSS 9.8 · Critical EPSS 0,95%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada oroinc oroplatform. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.

Rincian

Terbit di NVD

27 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/oroinc/platform/security/advisories/GHSA-9v3j-4j64-p937 patch · advisory vendor