PT-2023-15892 · Jatos · Jatos

Published 2023-01-06 · Updated 2024-05-17 · CVE-2022-4878

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions JATOS versions prior to 3.7.5-alpha

Description A critical vulnerability has been found in JATOS, affecting the ZipUtil function of the ZIP Handler component. This issue leads to path traversal.

Recommendations For versions prior to 3.7.5-alpha, upgrade to version 3.7.5-alpha to address this issue. As a temporary workaround, consider disabling the ZipUtil function until the patch is applied. Restrict access to the ZIP Handler component to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-4878

Affected Products

Jatos

References · 7

• https://github.com/JATOS/JATOS/releases/tag/v3.7.5-alpha · Patch
• https://github.com/JATOS/JATOS/commit/2b42519f309d8164e8811392770ce604cdabb5da · Patch
• https://osv.dev/vulnerability/CVE-2022-4878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4878 · Security Note
• https://t.me/cibsecurity/56036 · Telegram Post
• https://vuldb.com/?id.217548 · Note
• https://vuldb.com/?ctiid.217548 · Note