PT-2022-20466 · Bleve+1 · Bleve+1

Abhinavdangeti · Published 2022-06-01 · Updated 2025-07-03 · CVE-2022-31022

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bleve (affected versions not specified)

Description The issue concerns the bleve/http package, which is used for demonstration purposes and lacks authentication, authorization, and validation of user inputs. This allows attackers to exploit a node's filesystem where the bleve index resides, creating a bleve index or deleting directories recursively. Users who have used the bleve/http package without explicit handling for Role-Based Access Controls (RBAC) are impacted.

Recommendations Do not use the bleve/http package in production use cases, as it is intended for demonstration purposes only. As a temporary workaround, consider disabling the CreateIndexHandler and DeleteIndexHandler functions until alternative measures are implemented. Restrict access to the bleve index to minimize the risk of exploitation. Avoid using the bleve/http package without implementing explicit Role-Based Access Controls (RBAC) for the index assets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2022-31022

ECHO-D0BA-DD68-1D99

GHSA-9W9F-6MG8-JP7W

GO-2022-0470

OPENSUSE-SU-2025:15225-1

Affected Products

Bleve

Debian

References · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31022.json · Exploit
• https://github.com/blevesearch/bleve/commit/1c7509d6a17d36f265c90b4e8f4e3a3182fe79ff · Patch
• https://github.com/blevesearch/bleve/commit/af9e3111dadfedf9d30f0448506b4a57fecc8550 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31022 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15225-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31022 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31022 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0470 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31022 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31022 · Security Note
• https://osv.dev/vulnerability/GHSA-9w9f-6mg8-jp7w · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31022 · Vendor Advisory
• https://github.com/blevesearch/bleve/security/advisories/GHSA-9w9f-6mg8-jp7w · Note
• https://suse.com/security/cve/CVE-2025-2571 · Note