CVE-2022-37865criticalCWE-22

CVE-2022-37865: fallo crítico en Apache Ivy

Apache Ivy allows creating/overwriting any file on the system

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Ivy+ Monitorear org.apache.ivy:ivy

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 2.1%
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Productos afectados
Apache Software Foundation · Apache Ivy
CVEs relacionadas — Apache Ivy

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-46751HIGHApache Ivy: XML External Entity vulnerability in Apache IvyEPSS 2.0%CVE-2022-37866HIGHApache Ivy allows path traversal in the presence of a malicious repositoryEPSS 1.9%CVE-2026-26032MEDIUMApache Ivy: PackagerResolver path traversal vulnerabilityEPSS 0.5%