CVE-2022-4065 : A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this v

A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.

Published 2022-11-19 19:15:10

Updated 2024-05-17 02:16:33

Source VulDB

View at NVD, CVE.org

Vulnerability category: Directory traversal

Exploit prediction scoring system (EPSS) score for CVE-2022-4065

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 46 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-4065

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	VulDB
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
5.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L	2.1	3.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
5.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L	2.1	3.4	VulDB	2024-02-29
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-4065

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2022-4065

https://github.com/cbeust/testng/pull/2806

[SECURITY] Fix Zip Slip Vulnerability by JLLeitschuh · Pull Request #2806 · cbeust/testng · GitHub
Exploit;Patch;Third Party Advisory
https://vuldb.com/?ctiid.214027

Login required
https://vuldb.com/?id.214027

CVE-2022-4065 | cbeust testng XML File Parser JarFileUtils.java testngXmlExistsInJar path traversal (ID 2806)
Third Party Advisory
https://github.com/cbeust/testng/releases/tag/7.7.1

Release TestNG v7.7.1 · cbeust/testng · GitHub
https://github.com/cbeust/testng/commit/9150736cd2c123a6a3b60e6193630859f9f0422b

Merge pull request #2806 from BulkSecurityGeneratorProjectV2/fix/JLL/… · cbeust/testng@9150736 · GitHub
Patch;Third Party Advisory

Products affected by CVE-2022-4065

Testng Project » Testng » Version: N/A
cpe:2.3:a:testng_project:testng:-:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-4065

Exploit prediction scoring system (EPSS) score for CVE-2022-4065

CVSS scores for CVE-2022-4065

CWE ids for CVE-2022-4065

References for CVE-2022-4065

Products affected by CVE-2022-4065