A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The name of the patch is 2b42519f309d8164e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217548.
References
| Link | Resource |
|---|---|
| https://github.com/JATOS/JATOS/commit/2b42519f309d8164e8811392770ce604cdabb5da | Patch Third Party Advisory |
| https://github.com/JATOS/JATOS/releases/tag/v3.7.5-alpha | Release Notes Third Party Advisory |
| https://vuldb.com/?ctiid.217548 | Third Party Advisory |
| https://vuldb.com/?id.217548 | Third Party Advisory |
| https://github.com/JATOS/JATOS/commit/2b42519f309d8164e8811392770ce604cdabb5da | Patch Third Party Advisory |
| https://github.com/JATOS/JATOS/releases/tag/v3.7.5-alpha | Release Notes Third Party Advisory |
| https://vuldb.com/?ctiid.217548 | Third Party Advisory |
| https://vuldb.com/?id.217548 | Third Party Advisory |
Configurations
History
21 Nov 2024, 07:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/JATOS/JATOS/commit/2b42519f309d8164e8811392770ce604cdabb5da - Patch, Third Party Advisory | |
| References | () https://github.com/JATOS/JATOS/releases/tag/v3.7.5-alpha - Release Notes, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.217548 - Third Party Advisory | |
| References | () https://vuldb.com/?id.217548 - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.2
v3 : 5.5 |
Information
Published : 2023-01-06 10:15
Updated : 2024-11-21 07:36
NVD link : CVE-2022-4878
Mitre link : CVE-2022-4878
CVE.ORG link : CVE-2022-4878
JSON object : View
Products Affected
jatos
- jatos
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')