PT-2022-24878 · Melisplatform · Melis-Asset-Manager

Published 2022-10-11 · Updated 2022-10-14 · CVE-2022-39296

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions melisplatform/melis-asset-manager versions prior to 5.0.1

Description The issue allows attackers to read arbitrary files, leading to the disclosure of sensitive information. This can be done without requiring authentication. The problem was addressed by restricting access to files to intended directories only. Users should upgrade to a version that includes this fix.

Recommendations For versions prior to 5.0.1, upgrade to melisplatform/melis-asset-manager version 5.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories until the upgrade can be applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-39296

GHSA-7FJ2-RRQ6-RPHQ

Affected Products

Melis-Asset-Manager

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39296.json · Exploit
• https://github.com/melisplatform/melis-asset-manager/commit/a0f75918c049aff78953a0bc91c585153595d1bd · Patch
• https://github.com/melisplatform/melis-asset-manager/security/advisories/GHSA-7fj2-rrq6-rphq · Patch
• https://osv.dev/vulnerability/GHSA-7fj2-rrq6-rphq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39296 · Security Note
• https://github.com/melisplatform/melis-asset-manager · Note
• https://t.me/cibsecurity/51177 · Telegram Post