PT-2023-15473 · Kraken · Kraken

Yhy0O · CVE-2022-47747 · Published 2023-01-20 · Updated 2023-05-17

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions kraken versions 0.1.4 and earlier

Description The issue is related to an arbitrary file read vulnerability. It affects the component testfs.

Recommendations For kraken versions 0.1.4 and earlier, consider restricting access to the testfs component until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-47747

GHSA-HJ4G-4W36-X8HP

GO-2023-1505

Affected Products

Kraken

References · 12

• 🔥 https://github.com/uber/kraken/issues/333 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/47xxx/CVE-2022-47747.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-47747 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-47747 · Security Note
• https://osv.dev/vulnerability/GHSA-hj4g-4w36-x8hp · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-47747 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-47747 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1505 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47747 · Vendor Advisory
• https://github.com/uber/kraken · Note
• https://t.me/cibsecurity/56775 · Telegram Post
• https://github.com/advisories/GHSA-hj4g-4w36-x8hp · Note