CVE-2022-22932

CVE-2022-22932: vulnerability in Apache Karaf

Path traversal flaws

Published · Updated

Follow this CVE+ Monitor Apache Karaf+ Monitor org.apache.karaf:apache-karaf

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.8%
Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326
Affected products
Apache Software Foundation · Apache Karaf
Related CVEs — Apache Karaf

In the same product, most dangerous first.

CVE-2018-11788—CVE-2018-11788EPSS 7.3%CVE-2016-8750—CVE-2016-8750EPSS 5.2%CVE-2022-40145CRITICALApache Karaf: JDBC JAAS LDAP injectionEPSS 2.6%CVE-2018-11787—CVE-2018-11787EPSS 2.6%CVE-2021-41766—Insecure Java Deserialization in Apache KarafEPSS 2.0%CVE-2018-11786—CVE-2018-11786EPSS 1.9%