CVE-2022-41951highCWE-22

CVE-2022-41951: high-severity vulnerability in oroinc platform

OroPlatform vulnerable to path traversal during temporary file manipulations

Published · Updated

Follow this CVE+ Monitor platform+ Monitor oro/platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.9%
OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
oroinc · platform
Related CVEs — oroinc platform

In the same product, most dangerous first.

CVE-2021-43852HIGHJavaScript Prototype Pollution in oro/platformEPSS 1.1%CVE-2021-41236MEDIUMXSS vulnerability in oro/platformEPSS 0.7%CVE-2023-45824MEDIUMOroPlatform's pinned entity creation form shows pages of other usersEPSS 0.4%