CVE-2022-4493CWE-22

scifio ZIP File DefaultSampleFilesService.java downloadAndUnpackResource path traversal

Medium · published December 14, 2022

CVSS v3.1
6.3
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00582 · 47.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-12-14T00:00Z
EPSS history
Timeline
  • 14 DEC 00:00Z
    scifio ZIP File DefaultSampleFilesService.java downloadAndUnpackResource path traversal
    cvelistv5