CVE-2022-37865criticalCWE-22

CVE-2022-37865: falha crítica em Apache Ivy

Apache Ivy allows creating/overwriting any file on the system

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Ivy+ Monitorar org.apache.ivy:ivy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 2.1%
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on the local fie system that the user executing Ivy has write access to. Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy 2.5.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache Ivy
CVEs relacionadas — Apache Ivy

No mesmo produto, das mais perigosas para as menos.

CVE-2022-46751HIGHApache Ivy: XML External Entity vulnerability in Apache IvyEPSS 2.0%CVE-2022-37866HIGHApache Ivy allows path traversal in the presence of a malicious repositoryEPSS 1.9%CVE-2026-26032MEDIUMApache Ivy: PackagerResolver path traversal vulnerabilityEPSS 0.5%