CVE-2022-4772

low-risk
Published 2022-12-27

A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.

Do I need to act?

-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.5/10 Medium
LOCAL / HIGH complexity

Affected Products (1)

Widoco

Affected Vendors

Widoco Project

References (8)

Patch https://github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa9...
Third Party Advisory https://github.com/dgarijo/Widoco/pull/551
Third Party Advisory https://vuldb.com/?ctiid.216914
Third Party Advisory https://vuldb.com/?id.216914
Patch https://github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa9...
Third Party Advisory https://github.com/dgarijo/Widoco/pull/551
Third Party Advisory https://vuldb.com/?ctiid.216914
Third Party Advisory https://vuldb.com/?id.216914
17
/ 100
low-risk
Severity 12/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal