PT-2022-16068 · Alpine · Alpine

Alvaro Muñoz + 1 · Published 2022-12-28 · Updated 2024-08-05 · CVE-2022-23553

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Alpine versions prior to 1.10.4

Description Alpine is a scaffolding library in Java that allows URL access filter bypass. This issue has been fixed in version 1.10.4.

Recommendations For versions prior to 1.10.4, update to version 1.10.4 to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-23553

GHSA-2W4P-2HF7-GH8X

Affected Products

Alpine

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23553.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23553 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23553 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2w4p-2hf7-gh8x · Vendor Advisory
• https://github.com/stevespringett/Alpine/blob/alpine-parent-1.10.2/alpine/src/main/java/alpine/filters/WhitelistUrlFilter.java#L115-L127 · Note
• https://github.com/stevespringett/Alpine/releases/tag/alpine-parent-1.10.4 · Note
• https://github.com/stevespringett/Alpine · Note
• https://github.com/stevespringett/Alpine/commit/a7432184b9137ea095799a77f9ced370553acbd7 · Note
• https://github.com/stevespringett/Alpine/blob/alpine-parent-1.10.2/alpine/src/main/java/alpine/filters/BlacklistUrlFilter.java#L107-L121 · Note
• https://securitylab.github.com/advisories/GHSL-2021-1009-Alpine · Note
• https://t.me/cvenotify/54115 · Telegram Post
• https://securitylab.github.com/advisories · Note
• https://t.me/cibsecurity/55507 · Telegram Post