CVE-2022-41951CWE-22

OroPlatform vulnerable to path traversal during temporary file manipulations

High · published November 27, 2023

CVSS v3.1
8.6
EPSS
1%
Percentile
60.8
In the wild
Unconfirmed
What it is

OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Path Traversal is possible in `Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName`. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. This vulnerability has been fixed in version 5.0.9.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00946 · 60.8th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-11-27T20:27Z
EPSS history
Timeline
  • 27 NOV 20:27Z
    OroPlatform vulnerable to path traversal during temporary file manipulations
    cvelistv5