PT-2022-21208 · Apache · Apache Uima

Huangzhicong · Published 2022-11-03 · Updated 2023-05-22 · CVE-2022-32287

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache UIMA versions prior to 3.3.0

Description A relative path traversal vulnerability in the FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. PEAR files should never be installed into a UIMA installation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with the same privileges as the host Java Virtual Machine.

Recommendations For versions prior to 3.3.0, consider restricting the installation of PEAR files from untrusted sources to minimize the risk of exploitation. As a temporary workaround, carefully validate the ZIP entry names in PEAR archives before installation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-32287

GHSA-XGQR-5WQW-9FPV

Affected Products

Apache Uima

References · 11

• https://ubuntu.com/security/CVE-2022-32287 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xgqr-5wqw-9fpv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32287 · Security Note
• https://lists.apache.org/thread/57vk0d79j94d0lk0vol8xn935yv1shdd · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-32287 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-32287 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/11/03/4 · Note
• https://t.me/pentestingnews/29920 · Telegram Post
• https://t.me/cvenotify/50916 · Telegram Post
• https://t.me/cibsecurity/52501 · Telegram Post