PT-2022-16870 · Unknown · Cyclonedx Bom Repository Server

Florian Grunow

·

Published

2022-03-22

·

Updated

2023-06-30

·

CVE-2022-24774

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Name of the Vulnerable Software and Affected Versions CycloneDX BOM Repository Server versions prior to 2.0.1
Description The CycloneDX BOM Repository Server has an improper input validation issue leading to path traversal. This could allow a malicious user to create arbitrary directories or cause a denial of service by deleting arbitrary directories. The issue is not exploitable if the post and delete methods are disabled, which is the default configuration. This can be achieved by modifying the appsettings.json file or by setting the environment variables ALLOWEDMETHODS POST and ALLOWEDMETHODS DELETE to false.
Recommendations For CycloneDX BOM Repository Server versions prior to 2.0.1, update to version 2.0.1 to resolve the issue. As a temporary workaround, consider modifying the appsettings.json file to disable the post and delete methods, or set the environment variables ALLOWEDMETHODS POST and ALLOWEDMETHODS DELETE to false to prevent exploitation.

Exploit

Fix

Path traversal

RCE

Weakness Enumeration

Related Identifiers

CVE-2022-24774
GHSA-6C74-9588-WQ9J

Affected Products

Cyclonedx Bom Repository Server