{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-37866", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "dateUpdated": "2023-07-04T00:00:00", "dateReserved": "2022-08-08T00:00:00", "datePublished": "2022-11-07T00:00:00"}, "containers": {"cna": {"title": "Apache Ivy allows path traversal in the presence of a malicious repository", "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2023-07-04T00:00:00"}, "descriptions": [{"lang": "en", "value": "When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied \"pattern\" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain \"../\" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing \"..\" sequences and a \"normal\" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1."}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Ivy", "versions": [{"version": "2.0.0", "status": "affected", "lessThan": "unspecified", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "2.5.0", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b"}, {"name": "FEDORA-2023-35f775fd6e", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/"}], "credits": [{"lang": "en", "value": "This issue was discovered by Kostya Kortchinsky of the Databricks Security Team."}], "metrics": [{"other": {"type": "unknown", "content": {"other": "medium"}}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:ivy:*:*:*:*:*:*:*:*", "matchCriteriaId": "763540A0-083B-45AC-9C64-7E109FE0D21A", "versionEndExcluding": "2.5.1", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied \"pattern\" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain \"../\" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing \"..\" sequences and a \"normal\" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1."}, {"lang": "es", "value": "Cuando Apache Ivy descarga artefactos de un repositorio, los almacena en el sistema de archivos local seg\u00fan un \"patr\u00f3n\" proporcionado por el usuario que puede incluir marcadores de posici\u00f3n para las coordenadas de los artefactos, como la organizaci\u00f3n, el m\u00f3dulo o la versi\u00f3n. Si dichas coordenadas contienen secuencias \"../\", que son caracteres v\u00e1lidos para las coordenadas de Ivy en general, es posible que los artefactos se almacenen fuera del cach\u00e9 o repositorio local de Ivy o puedan sobrescribir diferentes artefactos dentro del cach\u00e9 local. Para aprovechar esta vulnerabilidad, un atacante necesita la colaboraci\u00f3n del repositorio remoto, ya que Ivy emitir\u00e1 solicitudes http que contienen secuencias \"..\" y un repositorio \"normal\" no las interpretar\u00e1 como parte de las coordenadas del artefacto. Los usuarios de Apache Ivy 2.0.0 a 2.5.1 deben actualizar a Ivy 2.5.1."}], "id": "CVE-2022-37866", "lastModified": "2023-11-07T03:49:53.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-11-07T14:15:12.357", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b"}, {"source": "security@apache.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@apache.org", "type": "Primary"}]}

{}