CVE-2022-38301

Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and directories via uploading a crafted JAR file into the directory /opt/onedev/lib.
Configurations

Configuration 1 (hide)

cpe:2.3:a:onedev_project:onedev:7.4.14:*:*:*:*:*:*:*

History

16 Sep 2022, 19:26

Type Values Removed Values Added
First Time Onedev Project
Onedev Project onedev
CWE CWE-22
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8
CPE cpe:2.3:a:onedev_project:onedev:7.4.14:*:*:*:*:*:*:*
References (MISC) https://github.com/theonedev/onedev/commit/5b6a19c1f7fe9c271acc4268bcd261a9a1cbb3ea - (MISC) https://github.com/theonedev/onedev/commit/5b6a19c1f7fe9c271acc4268bcd261a9a1cbb3ea - Patch, Third Party Advisory
References (MISC) https://research.loginsoft.com/vulnerability/path-traversal-in-onedev-v7-4-14/ - (MISC) https://research.loginsoft.com/vulnerability/path-traversal-in-onedev-v7-4-14/ - Exploit, Patch, Third Party Advisory

14 Sep 2022, 21:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-09-14 21:15

Updated : 2023-12-10 14:35


NVD link : CVE-2022-38301

Mitre link : CVE-2022-38301

CVE.ORG link : CVE-2022-38301


JSON object : View

Products Affected

onedev_project

  • onedev
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')