CVE-2022-39296highCWE-22

CVE-2022-39296: falha de alta gravidade em melisplatform melis-asset-manager

Path traversal in MelisAssetManager

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar melis-asset-manager+ Monitorar melisplatform/melis-asset-manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 1.9%
MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of `melisplatform/melis-asset-manager`, leading to the disclosure of sensitive information. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-asset-manager` >= 5.0.1. This issue was addressed by restricting access to files to intended directories only.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
melisplatform · melis-asset-manager