Vulnerability Details : CVE-2022-25882
Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"
Vulnerability category: Directory traversal
Products affected by CVE-2022-25882
- cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-25882
0.21%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-25882
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
Snyk |
CWE ids for CVE-2022-25882
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-25882
-
https://github.com/onnx/onnx/commit/f369b0e859024095d721f1d1612da5a8fa38988d
Do not allow to read tensor's external_data outside the model directo… · onnx/onnx@f369b0e · GitHubPatch;Third Party Advisory
-
https://github.com/onnx/onnx/blob/96516aecd4c110b0ac57eba08ac236ebf7205728/onnx/checker.cc%23L129
Page not found · GitHub · GitHubBroken Link
-
https://github.com/onnx/onnx/issues/3991
The onnx runtime allow to load the external_data from the file outside the folder · Issue #3991 · onnx/onnx · GitHubExploit;Third Party Advisory
-
https://github.com/onnx/onnx/pull/4400
Do not allow to read tensor's external_data outside the model directory by jnovikov · Pull Request #4400 · onnx/onnx · GitHubPatch;Third Party Advisory
-
https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479
Directory Traversal in onnx | CVE-2022-25882 | SnykExploit;Third Party Advisory
-
https://gist.github.com/jnovikov/02a9aff9bf2188033e77bd91ff062856
Onnx runtime poc · GitHubExploit;Third Party Advisory
Jump to