6.5

CVE-2022-22836

Exploit
CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Coreftp ≫ Core Ftp Version <= 1.2
Coreftp ≫ Core Ftp Version2.0 Updatebuild_639
Coreftp ≫ Core Ftp Version2.0 Updatebuild_640
Coreftp ≫ Core Ftp Version2.0 Updatebuild_641
Coreftp ≫ Core Ftp Version2.0 Updatebuild_642
Coreftp ≫ Core Ftp Version2.0 Updatebuild_645
Coreftp ≫ Core Ftp Version2.0 Updatebuild_647
Coreftp ≫ Core Ftp Version2.0 Updatebuild_649
Coreftp ≫ Core Ftp Version2.0 Updatebuild_651
Coreftp ≫ Core Ftp Version2.0 Updatebuild_653
Coreftp ≫ Core Ftp Version2.0 Updatebuild_655
Coreftp ≫ Core Ftp Version2.0 Updatebuild_656
Coreftp ≫ Core Ftp Version2.0 Updatebuild_657
Coreftp ≫ Core Ftp Version2.0 Updatebuild_658
Coreftp ≫ Core Ftp Version2.0 Updatebuild_659
Coreftp ≫ Core Ftp Version2.0 Updatebuild_665
Coreftp ≫ Core Ftp Version2.0 Updatebuild_667
Coreftp ≫ Core Ftp Version2.0 Updatebuild_668
Coreftp ≫ Core Ftp Version2.0 Updatebuild_671
Coreftp ≫ Core Ftp Version2.0 Updatebuild_673
Coreftp ≫ Core Ftp Version2.0 Updatebuild_674
Coreftp ≫ Core Ftp Version2.0 Updatebuild_676
Coreftp ≫ Core Ftp Version2.0 Updatebuild_677
Coreftp ≫ Core Ftp Version2.0 Updatebuild_679
Coreftp ≫ Core Ftp Version2.0 Updatebuild_682
Coreftp ≫ Core Ftp Version2.0 Updatebuild_687
Coreftp ≫ Core Ftp Version2.0 Updatebuild_689
Coreftp ≫ Core Ftp Version2.0 Updatebuild_691
Coreftp ≫ Core Ftp Version2.0 Updatebuild_694
Coreftp ≫ Core Ftp Version2.0 Updatebuild_695
Coreftp ≫ Core Ftp Version2.0 Updatebuild_697
Coreftp ≫ Core Ftp Version2.0 Updatebuild_699
Coreftp ≫ Core Ftp Version2.0 Updatebuild_702
Coreftp ≫ Core Ftp Version2.0 Updatebuild_704
Coreftp ≫ Core Ftp Version2.0 Updatebuild_705
Coreftp ≫ Core Ftp Version2.0 Updatebuild_711
Coreftp ≫ Core Ftp Version2.0 Updatebuild_713
Coreftp ≫ Core Ftp Version2.0 Updatebuild_715
Coreftp ≫ Core Ftp Version2.0 Updatebuild_719
Coreftp ≫ Core Ftp Version2.0 Updatebuild_725
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.13% 0.864
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.