CVE-2022-4772: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

December 28, 2022 (updated January 9, 2023)

A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.

References

github.com/advisories/GHSA-jj8r-jw42-mw4w
github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa92
github.com/dgarijo/Widoco/pull/551
nvd.nist.gov/vuln/detail/CVE-2022-4772
vuldb.com/?ctiid.216914
vuldb.com/?id.216914

Code Behaviors & Features

Detect and mitigate CVE-2022-4772 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →