PT-2022-27633 · Unknown · Ubi Reader

Qkaiser · CVE-2022-4572 · Published 2022-12-17 · Updated 2022-12-22

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions UBI Reader versions up to 0.8.0

Description A vulnerability has been found in the UBIFS File Handler component, specifically affecting the ubireader extract files function of the file ubireader/ubifs/output.py. This issue leads to path traversal and can be exploited remotely.

Recommendations For UBI Reader versions up to 0.8.0, upgrade to version 0.8.5 to address this issue. As a temporary workaround, consider restricting access to the ubireader extract files function until the upgrade is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-4572

GHSA-HC37-84V3-8GMQ

PYSEC-2022-43016

Affected Products

Ubi Reader

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4572.json · Exploit
• https://github.com/jrspruitt/ubi_reader/commit/d5d68e6b1b9f7070c29df5f67fc060f579ae9139 · Patch
• https://github.com/jrspruitt/ubi_reader/pull/57 · Patch
• https://osv.dev/vulnerability/GHSA-hc37-84v3-8gmq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4572 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4572 · Security Note
• https://github.com/jrspruitt/ubi_reader · Note
• https://github.com/jrspruitt/ubi_reader/releases/tag/v0.8.5-master · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ubi-reader/PYSEC-2022-43016.yaml · Note
• https://github.com/advisories/GHSA-hc37-84v3-8gmq · Note
• https://vuldb.com/?id.216146 · Note
• https://t.me/cvenotify/40424 · Telegram Post