CVE-2022-1518CWE-22

3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22

Critical · published June 24, 2022

CVSS v3.1
10.0
EPSS
2%
Percentile
76.0
In the wild
Unconfirmed
What it is

🚨 A sneaky directory traversal vulnerability lets attackers upload files outside the intended directory structure, turning LRM into their playground! 🔥 Think of it like a delivery person who can not only drop off packages at your home but also rummage through your entire neighborhood for spare keys. This flaw could allow an attacker to place malicious files where they shouldn't be! With this vulnerability, an attacker could potentially upload anything from dangerous scripts to sensitive data, leading to unauthorized access or even a complete takeover of the system. The consequences could be absolutely devastating, leaving your digital fortress wide open to exploitation.

Put simply

Think of it like a delivery person who can not only drop off packages at your home but also rummage through your entire neighborhood for spare keys. This flaw could allow an attacker to place malicious files where they shouldn't be! This directory traversal vulnerability in LRM allows attackers to manipulate file paths, enabling uploads of files outside the designated directories, which could compromise the integrity of the system.

What to do

With this vulnerability, an attacker could potentially upload anything from dangerous scripts to sensitive data, leading to unauthorized access or even a complete takeover of the system. The consequences could be absolutely devastating, leaving your digital fortress wide open to exploitation. To mitigate this critical vulnerability, update LRM to the latest version immediately, which addresses this issue. Additionally, implement strict path validation to ensure that uploads are only allowed within the intended directories. You've got this! With these steps, you'll be one step closer to reinforcing your defenses and achieving security hero status! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01630 · 76.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-06-24T15:00Z
EPSS history
Timeline
  • 24 JUN 15:00Z
    3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
    cvelistv5