GHSA-m9vj-44f3-78xw

Path traversal in CureKit

Source: GitHub Advisory Database (reviewed) High CVE-2022-23082

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.whitesource:curekit	>= 1.0.1, < 1.1.4	1.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function `isFileOutsideDir` fails to sanitize the user input which may lead to path traversal.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-23082 advisory
https://github.com/whitesource/CureKit/commit/af35e870ed09411d2f1fae6db1b04598cd1a31b6 web
https://github.com/whitesource/CureKit package
https://www.mend.io/vulnerability-database/CVE-2022-23082 web