Vulnerability Details : CVE-2022-4572
A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireader_extract_files of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be launched remotely. Upgrading to version 0.8.5 is able to address this issue. The name of the patch is d5d68e6b1b9f7070c29df5f67fc060f579ae9139. It is recommended to upgrade the affected component. VDB-216146 is the identifier assigned to this vulnerability.
Vulnerability category: Directory traversal
Products affected by CVE-2022-4572
- cpe:2.3:a:ubi_reader_project:ubi_reader:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-4572
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 21 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-4572
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
2.8
|
2.5
|
VulDB | |
|
7.1
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
1.8
|
5.2
|
NIST |
CWE ids for CVE-2022-4572
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: cna@vuldb.com (Primary)
References for CVE-2022-4572
-
https://github.com/jrspruitt/ubi_reader/pull/57
Fix path traversal vulnerability. by QKaiser · Pull Request #57 · jrspruitt/ubi_reader · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://github.com/jrspruitt/ubi_reader/releases/tag/v0.8.5-master
Release v0.8.5-master · jrspruitt/ubi_reader · GitHubRelease Notes;Third Party Advisory
-
https://github.com/jrspruitt/ubi_reader/commit/d5d68e6b1b9f7070c29df5f67fc060f579ae9139
Merge pull request #57 from onekey-sec/fix-path-traversal · jrspruitt/ubi_reader@d5d68e6 · GitHubPatch;Third Party Advisory
-
https://vuldb.com/?id.216146
CVE-2022-4572 | UBI Reader UBIFS File output.py ubireader_extract_files path traversal (ID 57)Third Party Advisory
Jump to