PT-2022-12964 · Litespeed Technologies · Openlitespeed Web Server+1

Published 2022-10-27 · Updated 2022-12-09 · CVE-2022-0072

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenLiteSpeed Web Server versions 1.5.11 through 1.5.12 OpenLiteSpeed Web Server versions 1.6.5 through 1.6.20.1 OpenLiteSpeed Web Server versions 1.7.0 through 1.7.16.0 LiteSpeed Web Server versions 1.5.11 through 1.5.12 LiteSpeed Web Server versions 1.6.5 through 1.6.20.1 LiteSpeed Web Server versions 1.7.0 through 1.7.16.0

Description A Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal.

Recommendations For OpenLiteSpeed Web Server versions 1.5.11 through 1.5.12, update to a version after 1.5.12. For OpenLiteSpeed Web Server versions 1.6.5 through 1.6.20.1, update to a version after 1.6.20.1. For OpenLiteSpeed Web Server versions 1.7.0 through 1.7.16.0, update to version 1.7.16.1 or later. For LiteSpeed Web Server versions 1.5.11 through 1.5.12, update to a version after 1.5.12. For LiteSpeed Web Server versions 1.6.5 through 1.6.20.1, update to a version after 1.6.20.1. For LiteSpeed Web Server versions 1.7.0 through 1.7.16.0, update to version 1.7.16.1 or later.

Exploit

Fix

Untrusted Search Path

Path traversal

Weakness Enumeration

CWE-426

CWE-22

Related Identifiers

BDU:2023-00698

CVE-2022-0072

Affected Products

Litespeed Web Server

Openlitespeed Web Server

References · 12

• 🔥 https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/src/main/httpserver.cpp#L2060-L2061 · Exploit
• 🔥 https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/src/main/httpserver.cpp#L2060-L2061 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0072 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0072 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00698 · Security Note
• https://github.com/litespeedtech/ols-dockerfiles/blob/master/template/Dockerfile#L29 · Note
• https://t.me/true_secator/3695 · Telegram Post
• https://t.me/thehackernews/2756 · Telegram Post
• https://blog.litespeedtech.com/2022/11/14/cve-2022-0072-cve-2022-0073-and-cve-2022-0074 · Note
• https://t.me/cvenotify/37090 · Telegram Post
• https://t.me/cibsecurity/52170 · Telegram Post
• https://sentinelone.com/blog/dragon-raas-pro-russian-hacktivist-group-aims-to-build-on-the-five-families-cybercrime-reputation · Note