PT-2022-16870 · Unknown · Cyclonedx Bom Repository Server
Florian Grunow
·
Published
2022-03-22
·
Updated
2023-06-30
·
CVE-2022-24774
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
CycloneDX BOM Repository Server versions prior to 2.0.1
Description
The CycloneDX BOM Repository Server has an improper input validation issue leading to path traversal. This could allow a malicious user to create arbitrary directories or cause a denial of service by deleting arbitrary directories. The issue is not exploitable if the post and delete methods are disabled, which is the default configuration. This can be achieved by modifying the
appsettings.json file or by setting the environment variables ALLOWEDMETHODS POST and ALLOWEDMETHODS DELETE to false.Recommendations
For CycloneDX BOM Repository Server versions prior to 2.0.1, update to version 2.0.1 to resolve the issue.
As a temporary workaround, consider modifying the
appsettings.json file to disable the post and delete methods, or set the environment variables ALLOWEDMETHODS POST and ALLOWEDMETHODS DELETE to false to prevent exploitation.Exploit
Fix
Path traversal
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cyclonedx Bom Repository Server