PT-2022-27633

CVE-2022-4572

Published

2022-12-17

Updated

2022-12-22

Description by

CVSS 4.0

6.9

Medium

MetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions UBI Reader versions up to 0.8.0

Description A vulnerability has been found in the UBIFS File Handler component, specifically affecting the ubireader extract files function of the file ubireader/ubifs/output.py. This issue leads to path traversal and can be exploited remotely.

Recommendations For UBI Reader versions up to 0.8.0, upgrade to version 0.8.5 to address this issue. As a temporary workaround, consider restricting access to the ubireader extract files function until the upgrade is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Qkaiser

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2022-4572